Overview
overview
10Static
static
3ForceCPU.exe
windows7-x64
1ForceCPU.exe
windows10-2004-x64
1HTCTL32.dll
windows7-x64
1HTCTL32.dll
windows10-2004-x64
3PCICHEK.dll
windows7-x64
1PCICHEK.dll
windows10-2004-x64
1PCICL32.dll
windows7-x64
1PCICL32.dll
windows10-2004-x64
1QWhale.Common.dll
windows7-x64
1QWhale.Common.dll
windows10-2004-x64
1QWhale.Editor.dll
windows7-x64
1QWhale.Editor.dll
windows10-2004-x64
1QWhale.Syntax.dll
windows7-x64
1QWhale.Syntax.dll
windows10-2004-x64
1SampleRules.js
windows7-x64
1SampleRules.js
windows10-2004-x64
1SimpleFilter.dll
windows7-x64
1SimpleFilter.dll
windows10-2004-x64
1TCCTL32.dll
windows7-x64
1TCCTL32.dll
windows10-2004-x64
1Timeline.dll
windows7-x64
1Timeline.dll
windows10-2004-x64
1client32.exe
windows7-x64
10client32.exe
windows10-2004-x64
10libssl-3-x64.dll
windows7-x64
1libssl-3-x64.dll
windows10-2004-x64
1msvcr100.dll
windows7-x64
3msvcr100.dll
windows10-2004-x64
3pcicapi.dll
windows7-x64
1pcicapi.dll
windows10-2004-x64
1remcmdstub.exe
windows7-x64
1remcmdstub.exe
windows10-2004-x64
1Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 01:57 UTC
Static task
static1
Behavioral task
behavioral1
Sample
ForceCPU.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ForceCPU.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
HTCTL32.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
HTCTL32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
PCICHEK.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
PCICHEK.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
PCICL32.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
PCICL32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
QWhale.Common.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
QWhale.Common.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
QWhale.Editor.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
QWhale.Editor.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
QWhale.Syntax.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
QWhale.Syntax.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
SampleRules.js
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
SampleRules.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
SimpleFilter.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
SimpleFilter.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
TCCTL32.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
TCCTL32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Timeline.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Timeline.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
client32.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
client32.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
libssl-3-x64.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
libssl-3-x64.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
msvcr100.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
msvcr100.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
pcicapi.dll
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
pcicapi.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
remcmdstub.exe
Resource
win7-20240215-en
Behavioral task
behavioral32
Sample
remcmdstub.exe
Resource
win10v2004-20240226-en
General
-
Target
HTCTL32.dll
-
Size
320KB
-
MD5
c94005d2dcd2a54e40510344e0bb9435
-
SHA1
55b4a1620c5d0113811242c20bd9870a1e31d542
-
SHA256
3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
-
SHA512
2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
-
SSDEEP
6144:Hib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKB:Hib5YbsXioEgULFpSzya9/lY5SilQCfR
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2592 3284 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1008 wrote to memory of 3284 1008 rundll32.exe 89 PID 1008 wrote to memory of 3284 1008 rundll32.exe 89 PID 1008 wrote to memory of 3284 1008 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\HTCTL32.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\HTCTL32.dll,#12⤵PID:3284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 6403⤵
- Program crash
PID:2592
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3284 -ip 32841⤵PID:3924
Network
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.178.17.96.in-addr.arpaIN PTRResponse209.178.17.96.in-addr.arpaIN PTRa96-17-178-209deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=3BC3FCF7CE036BB93C87E8CCCF246A10; domain=.bing.com; expires=Tue, 01-Apr-2025 01:57:10 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FF89B288454544C99BCDE4F5DA66E862 Ref B: LON04EDGE0615 Ref C: 2024-03-07T01:57:10Z
date: Thu, 07 Mar 2024 01:57:10 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3BC3FCF7CE036BB93C87E8CCCF246A10
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=R87nE3uoeJo5kHW_LDk4NymEzQOw-K9shR4yic48xkg; domain=.bing.com; expires=Tue, 01-Apr-2025 01:57:10 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C7E5C788BB0E4AC385D0306E8862A073 Ref B: LON04EDGE0615 Ref C: 2024-03-07T01:57:10Z
date: Thu, 07 Mar 2024 01:57:10 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3BC3FCF7CE036BB93C87E8CCCF246A10; MSPTC=R87nE3uoeJo5kHW_LDk4NymEzQOw-K9shR4yic48xkg
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D7FA3269B32A401DAF2055B57D2EFC5D Ref B: LON04EDGE0615 Ref C: 2024-03-07T01:57:10Z
date: Thu, 07 Mar 2024 01:57:10 GMT
-
Remote address:8.8.8.8:53Request198.52.96.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request195.177.78.104.in-addr.arpaIN PTRResponse195.177.78.104.in-addr.arpaIN PTRa104-78-177-195deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request0.204.248.87.in-addr.arpaIN PTRResponse0.204.248.87.in-addr.arpaIN PTRhttps-87-248-204-0lhrllnwnet
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request194.178.17.96.in-addr.arpaIN PTRResponse194.178.17.96.in-addr.arpaIN PTRa96-17-178-194deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request64.134.221.88.in-addr.arpaIN PTRResponse64.134.221.88.in-addr.arpaIN PTRa88-221-134-64deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request64.134.221.88.in-addr.arpaIN PTRResponse64.134.221.88.in-addr.arpaIN PTRa88-221-134-64deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418589_1A7GR0X7EOYKFPJ56&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239340418589_1A7GR0X7EOYKFPJ56&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 106065
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4FB0EA7F5A2E42BFA815CB776402DE2E Ref B: LON04EDGE0818 Ref C: 2024-03-07T01:58:48Z
date: Thu, 07 Mar 2024 01:58:48 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317300978_1LR278M4882TDZIMW&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317300978_1LR278M4882TDZIMW&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 371870
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9D57A7AE18954FC2932B0E5639FC78DF Ref B: LON04EDGE0818 Ref C: 2024-03-07T01:58:48Z
date: Thu, 07 Mar 2024 01:58:48 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301329_158N7EC87NQCHAYN7&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301329_158N7EC87NQCHAYN7&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 122631
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D5CFE9390EEA45DA8BAFA24625F85F20 Ref B: LON04EDGE0818 Ref C: 2024-03-07T01:58:48Z
date: Thu, 07 Mar 2024 01:58:48 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301411_15MW0N7QKPVBOUCK9&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301411_15MW0N7QKPVBOUCK9&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 501734
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9FA85A399CDC4730977DDC42AFB1C94A Ref B: LON04EDGE0818 Ref C: 2024-03-07T01:58:48Z
date: Thu, 07 Mar 2024 01:58:48 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418590_1Z5SLYPYIFLU5OB7B&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239340418590_1Z5SLYPYIFLU5OB7B&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 327824
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 597ED98D2AAE4756948C634526C2A086 Ref B: LON04EDGE0818 Ref C: 2024-03-07T01:58:48Z
date: Thu, 07 Mar 2024 01:58:48 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301738_1X6L2VINPQJNWJA05&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301738_1X6L2VINPQJNWJA05&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 526983
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6E6D2E0270974728B9601BDC4C108B0D Ref B: LON04EDGE0818 Ref C: 2024-03-07T01:58:48Z
date: Thu, 07 Mar 2024 01:58:48 GMT
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=tls, http22.0kB 9.2kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=72e61dab89634fe89788dd228411cc68&localId=w:A3E46398-2B40-9BBE-4B55-BFD97648970D&deviceId=6966557507656450&anid=HTTP Response
204 -
46 B 1
-
1.2kB 8.1kB 16 14
-
1.2kB 8.1kB 16 13
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301738_1X6L2VINPQJNWJA05&pid=21.2&w=1080&h=1920&c=4tls, http272.7kB 2.1MB 1513 1510
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418589_1A7GR0X7EOYKFPJ56&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317300978_1LR278M4882TDZIMW&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301329_158N7EC87NQCHAYN7&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301411_15MW0N7QKPVBOUCK9&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418590_1Z5SLYPYIFLU5OB7B&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301738_1X6L2VINPQJNWJA05&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200 -
1.2kB 8.1kB 16 14
-
1.2kB 8.1kB 16 14
-
72 B 158 B 1 1
DNS Request
140.32.126.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
209.178.17.96.in-addr.arpa
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
71 B 157 B 1 1
DNS Request
198.52.96.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
195.177.78.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
119.110.54.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
217.135.221.88.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.204.248.87.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
194.178.17.96.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
144 B 274 B 2 2
DNS Request
64.134.221.88.in-addr.arpa
DNS Request
64.134.221.88.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
14.227.111.52.in-addr.arpa
DNS Request
14.227.111.52.in-addr.arpa
-
142 B 157 B 2 1
DNS Request
43.58.199.20.in-addr.arpa
DNS Request
43.58.199.20.in-addr.arpa
-
124 B 346 B 2 2
DNS Request
tse1.mm.bing.net
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
DNS Response
204.79.197.20013.107.21.200