Analysis

  • max time kernel
    148s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-09-2024 06:36

General

  • Target

    f7c7d0bd153c8d765580e2d85b8312a1_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    f7c7d0bd153c8d765580e2d85b8312a1

  • SHA1

    9bb9e14e8c82f0b89f7a57e728c51676827bcfc8

  • SHA256

    5e29d859f5c04a364ed071e6b919ecec966730803577adc4006e34d1b1cc2229

  • SHA512

    06cfe8a830e83e620f4daec0dbfd09a25a1e35bf6357f78f6fff6e23218cdae571a6f863ba329aad167b2424bd6c1b53793e22b8ab234252af760a434f108be7

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZR:0UzeyQMS4DqodCnoe+iitjWwwF

Malware Config

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 56 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7c7d0bd153c8d765580e2d85b8312a1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f7c7d0bd153c8d765580e2d85b8312a1_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3900
      • C:\Users\Admin\AppData\Local\Temp\f7c7d0bd153c8d765580e2d85b8312a1_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\f7c7d0bd153c8d765580e2d85b8312a1_JaffaCakes118.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5012
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2548
          • \??\c:\windows\system\explorer.exe
            "c:\windows\system\explorer.exe"
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2440
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              PID:2568
              • \??\c:\windows\system\spoolsv.exe
                "c:\windows\system\spoolsv.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3896
                • \??\c:\windows\system\explorer.exe
                  c:\windows\system\explorer.exe
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3812
                  • \??\c:\windows\system\explorer.exe
                    "c:\windows\system\explorer.exe"
                    8⤵
                      PID:1456
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4724
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4628
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:392
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4580
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3208
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3540
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:1620
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:1624
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2580
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3796
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:2096
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:5008
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4360
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2332
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3164
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4308
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:1732
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4620
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:3176
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5016
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:2148
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:4024
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:4904
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4608
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4592
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2796
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5004
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:748
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:4108
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:924
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                PID:1300
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:376
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:2492
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4116
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3640
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1536
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:3876
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2656
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:3008
                • \??\c:\windows\system\spoolsv.exe
                  "c:\windows\system\spoolsv.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:4128
                  • \??\c:\windows\system\explorer.exe
                    c:\windows\system\explorer.exe
                    7⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:3472
                    • \??\c:\windows\system\explorer.exe
                      "c:\windows\system\explorer.exe"
                      8⤵
                        PID:5716
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:728
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1132
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:3284
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2432
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:2176
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:2204
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:3696
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1920
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Drops file in Windows directory
                  PID:4556
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:5032
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:832
                  • \??\c:\windows\system\spoolsv.exe
                    "c:\windows\system\spoolsv.exe"
                    6⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:4528
                    • \??\c:\windows\system\explorer.exe
                      c:\windows\system\explorer.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:1848
                      • \??\c:\windows\system\explorer.exe
                        "c:\windows\system\explorer.exe"
                        8⤵
                          PID:5684
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:2756
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:4064
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4060
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:3552
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:4176
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:964
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Drops file in Windows directory
                    PID:1140
                    • \??\c:\windows\system\spoolsv.exe
                      "c:\windows\system\spoolsv.exe"
                      6⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:2584
                      • \??\c:\windows\system\explorer.exe
                        c:\windows\system\explorer.exe
                        7⤵
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:4492
                        • \??\c:\windows\system\explorer.exe
                          "c:\windows\system\explorer.exe"
                          8⤵
                            PID:5740
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:1512
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:1644
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      PID:3148
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:3140
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:5080
                      • \??\c:\windows\system\spoolsv.exe
                        "c:\windows\system\spoolsv.exe"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:1296
                        • \??\c:\windows\system\explorer.exe
                          c:\windows\system\explorer.exe
                          7⤵
                          • Suspicious use of SetThreadContext
                          PID:4064
                          • \??\c:\windows\system\explorer.exe
                            "c:\windows\system\explorer.exe"
                            8⤵
                              PID:4816
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Drops file in Windows directory
                        PID:4624
                        • \??\c:\windows\system\spoolsv.exe
                          "c:\windows\system\spoolsv.exe"
                          6⤵
                          • System Location Discovery: System Language Discovery
                          PID:1840
                          • \??\c:\windows\system\explorer.exe
                            c:\windows\system\explorer.exe
                            7⤵
                            • Suspicious use of SetThreadContext
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:3456
                            • \??\c:\windows\system\explorer.exe
                              "c:\windows\system\explorer.exe"
                              8⤵
                                PID:2832
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Drops file in Windows directory
                          PID:1076
                          • \??\c:\windows\system\spoolsv.exe
                            "c:\windows\system\spoolsv.exe"
                            6⤵
                              PID:4388
                              • \??\c:\windows\system\explorer.exe
                                c:\windows\system\explorer.exe
                                7⤵
                                • Drops file in Windows directory
                                PID:636
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:4524
                            • \??\c:\windows\system\spoolsv.exe
                              "c:\windows\system\spoolsv.exe"
                              6⤵
                                PID:5524
                                • \??\c:\windows\system\explorer.exe
                                  c:\windows\system\explorer.exe
                                  7⤵
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  PID:5400
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Windows directory
                              PID:2912
                              • \??\c:\windows\system\spoolsv.exe
                                "c:\windows\system\spoolsv.exe"
                                6⤵
                                  PID:5780
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                    • Drops file in Windows directory
                                    PID:5972
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • Suspicious use of SetThreadContext
                                • Drops file in Windows directory
                                PID:2324
                                • \??\c:\windows\system\spoolsv.exe
                                  "c:\windows\system\spoolsv.exe"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:6136
                                  • \??\c:\windows\system\explorer.exe
                                    c:\windows\system\explorer.exe
                                    7⤵
                                      PID:2692
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:852
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3584
                                    • \??\c:\windows\system\explorer.exe
                                      c:\windows\system\explorer.exe
                                      7⤵
                                      • Drops file in Windows directory
                                      PID:5988
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • Suspicious use of SetThreadContext
                                  • Drops file in Windows directory
                                  PID:4348
                                  • \??\c:\windows\system\spoolsv.exe
                                    "c:\windows\system\spoolsv.exe"
                                    6⤵
                                      PID:6048
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • Drops file in Windows directory
                                    PID:2864
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3412
                                      • \??\c:\windows\system\explorer.exe
                                        c:\windows\system\explorer.exe
                                        7⤵
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:4612
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:1912
                                    • \??\c:\windows\system\spoolsv.exe
                                      "c:\windows\system\spoolsv.exe"
                                      6⤵
                                        PID:5936
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:180
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4332
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                      • Suspicious use of SetThreadContext
                                      PID:3516
                                      • \??\c:\windows\system\spoolsv.exe
                                        "c:\windows\system\spoolsv.exe"
                                        6⤵
                                          PID:6068
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Suspicious use of SetThreadContext
                                        PID:4848
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:6132
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • Suspicious use of SetThreadContext
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        PID:4504
                                        • \??\c:\windows\system\spoolsv.exe
                                          "c:\windows\system\spoolsv.exe"
                                          6⤵
                                            PID:5516
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Suspicious use of SetThreadContext
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:400
                                          • \??\c:\windows\system\spoolsv.exe
                                            "c:\windows\system\spoolsv.exe"
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1828
                                            • \??\c:\windows\system\explorer.exe
                                              c:\windows\system\explorer.exe
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:512
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:4940
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:5228
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:5792
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:3088
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:5312
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:5940
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:2208
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:5600
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:6140
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:1340
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:5552
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          PID:5440
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:2548
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • Drops file in Windows directory
                                          PID:5672
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                            PID:5488
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                              PID:2792
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                      1⤵
                                        PID:2664

                                      Network

                                      • flag-us
                                        DNS
                                        154.239.44.20.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        154.239.44.20.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        88.210.23.2.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        88.210.23.2.in-addr.arpa
                                        IN PTR
                                        Response
                                        88.210.23.2.in-addr.arpa
                                        IN PTR
                                        a2-23-210-88deploystaticakamaitechnologiescom
                                      • flag-us
                                        DNS
                                        72.32.126.40.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        72.32.126.40.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        95.221.229.192.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        95.221.229.192.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        57.169.31.20.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        57.169.31.20.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        217.106.137.52.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        217.106.137.52.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        26.165.165.52.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        26.165.165.52.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        206.23.85.13.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        206.23.85.13.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        240.221.184.93.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        240.221.184.93.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        83.210.23.2.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        83.210.23.2.in-addr.arpa
                                        IN PTR
                                        Response
                                        83.210.23.2.in-addr.arpa
                                        IN PTR
                                        a2-23-210-83deploystaticakamaitechnologiescom
                                      • flag-us
                                        DNS
                                        43.229.111.52.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        43.229.111.52.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        tse1.mm.bing.net
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        tse1.mm.bing.net
                                        IN A
                                        Response
                                        tse1.mm.bing.net
                                        IN CNAME
                                        mm-mm.bing.net.trafficmanager.net
                                        mm-mm.bing.net.trafficmanager.net
                                        IN CNAME
                                        ax-0001.ax-msedge.net
                                        ax-0001.ax-msedge.net
                                        IN A
                                        150.171.27.10
                                        ax-0001.ax-msedge.net
                                        IN A
                                        150.171.28.10
                                      • flag-us
                                        GET
                                        https://tse1.mm.bing.net/th?id=OADD2.10239317301309_1JFFGJ64L9I4K3JMP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                        Remote address:
                                        150.171.27.10:443
                                        Request
                                        GET /th?id=OADD2.10239317301309_1JFFGJ64L9I4K3JMP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                        host: tse1.mm.bing.net
                                        accept: */*
                                        accept-encoding: gzip, deflate, br
                                        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                        Response
                                        HTTP/2.0 200
                                        cache-control: public, max-age=2592000
                                        content-length: 299452
                                        content-type: image/jpeg
                                        x-cache: TCP_HIT
                                        access-control-allow-origin: *
                                        access-control-allow-headers: *
                                        access-control-allow-methods: GET, POST, OPTIONS
                                        timing-allow-origin: *
                                        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                        x-msedge-ref: Ref A: E14C029350D74E4598356FDBB1162EAA Ref B: LON601060101062 Ref C: 2024-09-26T06:38:01Z
                                        date: Thu, 26 Sep 2024 06:38:01 GMT
                                      • flag-us
                                        GET
                                        https://tse1.mm.bing.net/th?id=OADD2.10239340418556_19ZNSNV8II35KT0LW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                        Remote address:
                                        150.171.27.10:443
                                        Request
                                        GET /th?id=OADD2.10239340418556_19ZNSNV8II35KT0LW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                        host: tse1.mm.bing.net
                                        accept: */*
                                        accept-encoding: gzip, deflate, br
                                        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                        Response
                                        HTTP/2.0 200
                                        cache-control: public, max-age=2592000
                                        content-length: 589124
                                        content-type: image/jpeg
                                        x-cache: TCP_HIT
                                        access-control-allow-origin: *
                                        access-control-allow-headers: *
                                        access-control-allow-methods: GET, POST, OPTIONS
                                        timing-allow-origin: *
                                        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                        x-msedge-ref: Ref A: 915567B734A84D0490943CDA825FB66C Ref B: LON601060101062 Ref C: 2024-09-26T06:38:01Z
                                        date: Thu, 26 Sep 2024 06:38:01 GMT
                                      • flag-us
                                        GET
                                        https://tse1.mm.bing.net/th?id=OADD2.10239340418555_1KV8ALUFBH6DDF1AN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                        Remote address:
                                        150.171.27.10:443
                                        Request
                                        GET /th?id=OADD2.10239340418555_1KV8ALUFBH6DDF1AN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                        host: tse1.mm.bing.net
                                        accept: */*
                                        accept-encoding: gzip, deflate, br
                                        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                        Response
                                        HTTP/2.0 200
                                        cache-control: public, max-age=2592000
                                        content-length: 712275
                                        content-type: image/jpeg
                                        x-cache: TCP_HIT
                                        access-control-allow-origin: *
                                        access-control-allow-headers: *
                                        access-control-allow-methods: GET, POST, OPTIONS
                                        timing-allow-origin: *
                                        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                        x-msedge-ref: Ref A: 20DE2C999D1D483589481ABF064E644A Ref B: LON601060101062 Ref C: 2024-09-26T06:38:01Z
                                        date: Thu, 26 Sep 2024 06:38:01 GMT
                                      • flag-us
                                        GET
                                        https://tse1.mm.bing.net/th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                        Remote address:
                                        150.171.27.10:443
                                        Request
                                        GET /th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                        host: tse1.mm.bing.net
                                        accept: */*
                                        accept-encoding: gzip, deflate, br
                                        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                        Response
                                        HTTP/2.0 200
                                        cache-control: public, max-age=2592000
                                        content-length: 550329
                                        content-type: image/jpeg
                                        x-cache: TCP_HIT
                                        access-control-allow-origin: *
                                        access-control-allow-headers: *
                                        access-control-allow-methods: GET, POST, OPTIONS
                                        timing-allow-origin: *
                                        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                        x-msedge-ref: Ref A: 9A2AB62752C54E7CB390E8F8CA3DAB47 Ref B: LON601060101062 Ref C: 2024-09-26T06:38:01Z
                                        date: Thu, 26 Sep 2024 06:38:01 GMT
                                      • flag-us
                                        GET
                                        https://tse1.mm.bing.net/th?id=OADD2.10239317301718_1O49LH3F36Y9OZ53W&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                        Remote address:
                                        150.171.27.10:443
                                        Request
                                        GET /th?id=OADD2.10239317301718_1O49LH3F36Y9OZ53W&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                        host: tse1.mm.bing.net
                                        accept: */*
                                        accept-encoding: gzip, deflate, br
                                        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                        Response
                                        HTTP/2.0 200
                                        cache-control: public, max-age=2592000
                                        content-length: 267906
                                        content-type: image/jpeg
                                        x-cache: TCP_HIT
                                        access-control-allow-origin: *
                                        access-control-allow-headers: *
                                        access-control-allow-methods: GET, POST, OPTIONS
                                        timing-allow-origin: *
                                        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                        x-msedge-ref: Ref A: D4A43E387FB34495AD0088DED7D067A5 Ref B: LON601060101062 Ref C: 2024-09-26T06:38:01Z
                                        date: Thu, 26 Sep 2024 06:38:01 GMT
                                      • flag-us
                                        GET
                                        https://tse1.mm.bing.net/th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                        Remote address:
                                        150.171.27.10:443
                                        Request
                                        GET /th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                        host: tse1.mm.bing.net
                                        accept: */*
                                        accept-encoding: gzip, deflate, br
                                        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                        Response
                                        HTTP/2.0 200
                                        cache-control: public, max-age=2592000
                                        content-length: 586035
                                        content-type: image/jpeg
                                        x-cache: TCP_HIT
                                        access-control-allow-origin: *
                                        access-control-allow-headers: *
                                        access-control-allow-methods: GET, POST, OPTIONS
                                        timing-allow-origin: *
                                        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                        x-msedge-ref: Ref A: A622BEEA3E564F358D49E476E21FA3BD Ref B: LON601060101062 Ref C: 2024-09-26T06:38:05Z
                                        date: Thu, 26 Sep 2024 06:38:04 GMT
                                      • flag-us
                                        DNS
                                        10.27.171.150.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        10.27.171.150.in-addr.arpa
                                        IN PTR
                                        Response
                                      • 150.171.27.10:443
                                        https://tse1.mm.bing.net/th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                        tls, http2
                                        110.2kB
                                        3.1MB
                                        2277
                                        2271

                                        HTTP Request

                                        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301309_1JFFGJ64L9I4K3JMP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                        HTTP Request

                                        GET https://tse1.mm.bing.net/th?id=OADD2.10239340418556_19ZNSNV8II35KT0LW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                        HTTP Request

                                        GET https://tse1.mm.bing.net/th?id=OADD2.10239340418555_1KV8ALUFBH6DDF1AN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                        HTTP Request

                                        GET https://tse1.mm.bing.net/th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                        HTTP Request

                                        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301718_1O49LH3F36Y9OZ53W&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                        HTTP Response

                                        200

                                        HTTP Response

                                        200

                                        HTTP Response

                                        200

                                        HTTP Response

                                        200

                                        HTTP Response

                                        200

                                        HTTP Request

                                        GET https://tse1.mm.bing.net/th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                        HTTP Response

                                        200
                                      • 150.171.27.10:443
                                        tse1.mm.bing.net
                                        tls, http2
                                        1.2kB
                                        6.9kB
                                        15
                                        13
                                      • 150.171.27.10:443
                                        tse1.mm.bing.net
                                        tls, http2
                                        1.2kB
                                        6.9kB
                                        15
                                        13
                                      • 150.171.27.10:443
                                        tse1.mm.bing.net
                                        tls, http2
                                        1.2kB
                                        6.9kB
                                        15
                                        13
                                      • 8.8.8.8:53
                                        154.239.44.20.in-addr.arpa
                                        dns
                                        72 B
                                        158 B
                                        1
                                        1

                                        DNS Request

                                        154.239.44.20.in-addr.arpa

                                      • 8.8.8.8:53
                                        88.210.23.2.in-addr.arpa
                                        dns
                                        70 B
                                        133 B
                                        1
                                        1

                                        DNS Request

                                        88.210.23.2.in-addr.arpa

                                      • 8.8.8.8:53
                                        72.32.126.40.in-addr.arpa
                                        dns
                                        71 B
                                        157 B
                                        1
                                        1

                                        DNS Request

                                        72.32.126.40.in-addr.arpa

                                      • 8.8.8.8:53
                                        95.221.229.192.in-addr.arpa
                                        dns
                                        73 B
                                        144 B
                                        1
                                        1

                                        DNS Request

                                        95.221.229.192.in-addr.arpa

                                      • 8.8.8.8:53
                                        57.169.31.20.in-addr.arpa
                                        dns
                                        71 B
                                        157 B
                                        1
                                        1

                                        DNS Request

                                        57.169.31.20.in-addr.arpa

                                      • 8.8.8.8:53
                                        217.106.137.52.in-addr.arpa
                                        dns
                                        73 B
                                        147 B
                                        1
                                        1

                                        DNS Request

                                        217.106.137.52.in-addr.arpa

                                      • 8.8.8.8:53
                                        26.165.165.52.in-addr.arpa
                                        dns
                                        72 B
                                        146 B
                                        1
                                        1

                                        DNS Request

                                        26.165.165.52.in-addr.arpa

                                      • 8.8.8.8:53
                                        206.23.85.13.in-addr.arpa
                                        dns
                                        71 B
                                        145 B
                                        1
                                        1

                                        DNS Request

                                        206.23.85.13.in-addr.arpa

                                      • 8.8.8.8:53
                                        240.221.184.93.in-addr.arpa
                                        dns
                                        73 B
                                        144 B
                                        1
                                        1

                                        DNS Request

                                        240.221.184.93.in-addr.arpa

                                      • 8.8.8.8:53
                                        83.210.23.2.in-addr.arpa
                                        dns
                                        70 B
                                        133 B
                                        1
                                        1

                                        DNS Request

                                        83.210.23.2.in-addr.arpa

                                      • 8.8.8.8:53
                                        43.229.111.52.in-addr.arpa
                                        dns
                                        72 B
                                        158 B
                                        1
                                        1

                                        DNS Request

                                        43.229.111.52.in-addr.arpa

                                      • 8.8.8.8:53
                                        tse1.mm.bing.net
                                        dns
                                        62 B
                                        170 B
                                        1
                                        1

                                        DNS Request

                                        tse1.mm.bing.net

                                        DNS Response

                                        150.171.27.10
                                        150.171.28.10

                                      • 8.8.8.8:53
                                        10.27.171.150.in-addr.arpa
                                        dns
                                        72 B
                                        158 B
                                        1
                                        1

                                        DNS Request

                                        10.27.171.150.in-addr.arpa

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Windows\Parameters.ini

                                        Filesize

                                        74B

                                        MD5

                                        6687785d6a31cdf9a5f80acb3abc459b

                                        SHA1

                                        1ddda26cc18189770eaaa4a9e78cc4abe4fe39c9

                                        SHA256

                                        3b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b

                                        SHA512

                                        5fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962

                                      • C:\Windows\System\explorer.exe

                                        Filesize

                                        2.2MB

                                        MD5

                                        710467b96c8108965591e45651609e5b

                                        SHA1

                                        978a554aca2105c4f03a930eb5900c6b271ac6e7

                                        SHA256

                                        329e10a5db09b77e4db5e22c794b9b78e27bc42ff83c88e613fae2f53a9f9844

                                        SHA512

                                        3cb4195a7dc20acd6435d2c4b0f8071c1a554fc9629f833b52f2a0d282ca95aacdba4fd2dba6eab5776f35fdb85e6e1f40605bed2b736e789c9519f54ec3980b

                                      • C:\Windows\System\spoolsv.exe

                                        Filesize

                                        2.2MB

                                        MD5

                                        6479c6b3d19ab36a9515c48e93c3999b

                                        SHA1

                                        b4afc303daf05199cf605e268801aad0eeb5240c

                                        SHA256

                                        8d6c574975eef80cb8c3cf4328b0a1d42e55b087504a9af45940caa85502ba96

                                        SHA512

                                        1e0b5d74039dbbd3c32dc1b3c51f46a5ee2d84873931015bb25dfbef045789129518e146d7ba59b0836772c78b16e338813a1128966bdc5cd7e9bf5abdbf58e7

                                      • memory/392-2094-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/392-1021-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/728-1998-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/748-2762-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/924-4454-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/964-3092-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/1132-2862-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/1296-3626-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/1296-3506-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/1300-1705-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/1456-3500-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/1536-2679-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/1624-3909-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/1644-3272-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/1732-1336-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/1828-5684-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/1840-4030-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2096-1154-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/2176-2083-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/2204-2885-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2204-2889-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2332-2305-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2432-2877-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2440-673-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2440-4365-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2440-79-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2492-1706-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/2548-78-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/2548-73-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/2568-2005-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/2568-770-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/2580-1153-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/2584-3186-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2656-2688-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2796-2494-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2796-2499-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2832-5501-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/2880-37-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/2880-0-0x0000000002370000-0x0000000002371000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2880-32-0x0000000002370000-0x0000000002371000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2880-31-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/3008-1901-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/3140-3282-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/3164-1285-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/3176-1383-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/3208-2192-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/3208-1082-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/3284-2077-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/3412-5549-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/3412-5349-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/3540-2194-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/3552-3082-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/3584-5270-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/3640-1769-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/3696-2097-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/3796-2277-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/3876-1836-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/3896-2004-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/3896-2175-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4024-4122-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4064-3070-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4064-3073-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4128-2779-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4128-2969-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4308-2316-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4332-5378-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4360-1229-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/4388-4238-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4388-4128-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4528-2975-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4556-2193-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/4580-2098-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4592-1501-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/4608-2486-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4628-2088-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4628-2085-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4724-2086-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/4724-845-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/4816-5364-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/4904-1500-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/5004-1638-0x0000000000400000-0x00000000005D3000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/5008-2293-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5008-2296-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5012-34-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5012-35-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5012-67-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5016-2406-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5032-2908-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5032-2912-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5516-5490-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5524-4571-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5684-4930-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5716-4728-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5780-4852-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/5936-5368-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/6048-5182-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/6068-5387-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/6132-5394-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/6132-5398-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/6136-5145-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      • memory/6136-5019-0x0000000000400000-0x000000000043E000-memory.dmp

                                        Filesize

                                        248KB

                                      We care about your privacy.

                                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.