Overview

overview

10

Static

static

3

1c4ef8c0ca...18.exe

windows7-x64

10

1c4ef8c0ca...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2024, 19:58 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1c4ef8c0cad4fad9a4735b4e6ae35ee1_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    1c4ef8c0cad4fad9a4735b4e6ae35ee1

  • SHA1

    320ade0083ffceb27eb6d9c2f3b51d37d92c9b11

  • SHA256

    1d86868abe3436a74914d85ba25f32995e80e91b73ab471a5e20f791bb1ce28a

  • SHA512

    05e22ae1755b4d99a618edd98cf03538b7b48e5e6dc5d4e0619511066d6d6408c744fb5424533ecc15b8fa173bef597dd31f8420ffd5a967d1f90e025da990c9

  • SSDEEP

    24576:zk4slMippnVRuA+Rk3bwtXbyEnk02qFbHzKZ8u4wObL36v3Dp2:z4MWnVRuA+Rsw9byEnr2qFbH88uRNv3I

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:776
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:784
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:388
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2840
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2484
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:3100
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3440
                  • C:\Users\Admin\AppData\Local\Temp\1c4ef8c0cad4fad9a4735b4e6ae35ee1_JaffaCakes118.exe
                    "C:\Users\Admin\AppData\Local\Temp\1c4ef8c0cad4fad9a4735b4e6ae35ee1_JaffaCakes118.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:1280
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3568
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3760
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3864
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3928
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4012
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:3900
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:3336
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:1608
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                  1⤵
                                    PID:2224
                                  • C:\Windows\system32\backgroundTaskHost.exe
                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                    1⤵
                                      PID:2328

                                    Network

                                    • flag-us
                                      DNS
                                      8.8.8.8.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      8.8.8.8.in-addr.arpa
                                      IN PTR
                                      Response
                                      8.8.8.8.in-addr.arpa
                                      IN PTR
                                      dnsgoogle
                                    • flag-us
                                      DNS
                                      241.150.49.20.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      241.150.49.20.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      172.214.232.199.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      172.214.232.199.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      68.32.126.40.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      68.32.126.40.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      55.36.223.20.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      55.36.223.20.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      g.bing.com
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      g.bing.com
                                      IN A
                                      Response
                                      g.bing.com
                                      IN CNAME
                                      g-bing-com.dual-a-0034.a-msedge.net
                                      g-bing-com.dual-a-0034.a-msedge.net
                                      IN CNAME
                                      dual-a-0034.a-msedge.net
                                      dual-a-0034.a-msedge.net
                                      IN A
                                      13.107.21.237
                                      dual-a-0034.a-msedge.net
                                      IN A
                                      204.79.197.237
                                    • flag-us
                                      GET
                                      https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8MT35ORLvHd03ImQofxCG_zVUCUxtkI1clct017HOkcrxLuoBQcJ0xCVGD_01gV36uPPM0tPI1Cth--1s9m6go4U55e1H5Yp4VkBWnEQFtr7CP15MMcSAATuU2aY96pqHHAZbf1lyTOb2iencz97ugU8aLB6DyJPxVFSjEYEmAlarFA6_%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D3c30fc32ba061d2282d19a5a1e83d0de&TIME=20240611T192557Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407&muid=82EA48EC8031841EBBBB3EE75126D09B
                                      backgroundTaskHost.exe
                                      Remote address:
                                      13.107.21.237:443
                                      Request
                                      GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8MT35ORLvHd03ImQofxCG_zVUCUxtkI1clct017HOkcrxLuoBQcJ0xCVGD_01gV36uPPM0tPI1Cth--1s9m6go4U55e1H5Yp4VkBWnEQFtr7CP15MMcSAATuU2aY96pqHHAZbf1lyTOb2iencz97ugU8aLB6DyJPxVFSjEYEmAlarFA6_%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D3c30fc32ba061d2282d19a5a1e83d0de&TIME=20240611T192557Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407&muid=82EA48EC8031841EBBBB3EE75126D09B HTTP/2.0
                                      host: g.bing.com
                                      accept-encoding: gzip, deflate
                                      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                      Response
                                      HTTP/2.0 204
                                      cache-control: no-cache, must-revalidate
                                      pragma: no-cache
                                      expires: Fri, 01 Jan 1990 00:00:00 GMT
                                      set-cookie: MUID=32F27B771EDE693B11256FD81F3E686E; domain=.bing.com; expires=Sat, 26-Jul-2025 20:12:05 GMT; path=/; SameSite=None; Secure; Priority=High;
                                      strict-transport-security: max-age=31536000; includeSubDomains; preload
                                      access-control-allow-origin: *
                                      x-cache: CONFIG_NOCACHE
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 79277D038A464CF591C8AA1E8730A9E3 Ref B: LON04EDGE1116 Ref C: 2024-07-01T20:12:05Z
                                      date: Mon, 01 Jul 2024 20:12:05 GMT
                                    • flag-us
                                      GET
                                      https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8MT35ORLvHd03ImQofxCG_zVUCUxtkI1clct017HOkcrxLuoBQcJ0xCVGD_01gV36uPPM0tPI1Cth--1s9m6go4U55e1H5Yp4VkBWnEQFtr7CP15MMcSAATuU2aY96pqHHAZbf1lyTOb2iencz97ugU8aLB6DyJPxVFSjEYEmAlarFA6_%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D3c30fc32ba061d2282d19a5a1e83d0de&TIME=20240611T192557Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407&muid=82EA48EC8031841EBBBB3EE75126D09B
                                      backgroundTaskHost.exe
                                      Remote address:
                                      13.107.21.237:443
                                      Request
                                      GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8MT35ORLvHd03ImQofxCG_zVUCUxtkI1clct017HOkcrxLuoBQcJ0xCVGD_01gV36uPPM0tPI1Cth--1s9m6go4U55e1H5Yp4VkBWnEQFtr7CP15MMcSAATuU2aY96pqHHAZbf1lyTOb2iencz97ugU8aLB6DyJPxVFSjEYEmAlarFA6_%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D3c30fc32ba061d2282d19a5a1e83d0de&TIME=20240611T192557Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407&muid=82EA48EC8031841EBBBB3EE75126D09B HTTP/2.0
                                      host: g.bing.com
                                      accept-encoding: gzip, deflate
                                      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                      cookie: MUID=32F27B771EDE693B11256FD81F3E686E; _EDGE_S=SID=1B6EE6B380696E3F20D5F21C81C36F22
                                      Response
                                      HTTP/2.0 204
                                      cache-control: no-cache, must-revalidate
                                      pragma: no-cache
                                      expires: Fri, 01 Jan 1990 00:00:00 GMT
                                      set-cookie: MSPTC=CB1e3vdC1un29yuxYp3Js6dW9k9doiKLWGRQvL8H3WI; domain=.bing.com; expires=Sat, 26-Jul-2025 20:12:06 GMT; path=/; Partitioned; secure; SameSite=None
                                      strict-transport-security: max-age=31536000; includeSubDomains; preload
                                      access-control-allow-origin: *
                                      x-cache: CONFIG_NOCACHE
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 2BECBC21789844058FAE8C62F4DE9AFB Ref B: LON04EDGE1116 Ref C: 2024-07-01T20:12:06Z
                                      date: Mon, 01 Jul 2024 20:12:05 GMT
                                    • flag-be
                                      GET
                                      https://www.bing.com/aes/c.gif?RG=57b3a8eabb3d481ca920ba845f1afd70&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T192557Z&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407
                                      backgroundTaskHost.exe
                                      Remote address:
                                      88.221.83.217:443
                                      Request
                                      GET /aes/c.gif?RG=57b3a8eabb3d481ca920ba845f1afd70&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T192557Z&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407 HTTP/2.0
                                      host: www.bing.com
                                      accept-encoding: gzip, deflate
                                      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                      cookie: MUID=32F27B771EDE693B11256FD81F3E686E
                                      Response
                                      HTTP/2.0 200
                                      cache-control: private,no-store
                                      pragma: no-cache
                                      vary: Origin
                                      p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 0397231CEE994091A414B063694910F8 Ref B: DUS30EDGE0711 Ref C: 2024-07-01T20:12:06Z
                                      content-length: 0
                                      date: Mon, 01 Jul 2024 20:12:06 GMT
                                      set-cookie: _EDGE_S=SID=1B6EE6B380696E3F20D5F21C81C36F22; path=/; httponly; domain=bing.com
                                      set-cookie: MUIDB=32F27B771EDE693B11256FD81F3E686E; path=/; httponly; expires=Sat, 26-Jul-2025 20:12:06 GMT
                                      alt-svc: h3=":443"; ma=93600
                                      x-cdn-traceid: 0.d553dd58.1719864726.1330de1
                                    • flag-us
                                      DNS
                                      237.21.107.13.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      237.21.107.13.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      217.83.221.88.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      217.83.221.88.in-addr.arpa
                                      IN PTR
                                      Response
                                      217.83.221.88.in-addr.arpa
                                      IN PTR
                                      a88-221-83-217deploystaticakamaitechnologiescom
                                    • flag-us
                                      DNS
                                      104.219.191.52.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      104.219.191.52.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      58.55.71.13.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      58.55.71.13.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      183.59.114.20.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      183.59.114.20.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      15.164.165.52.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      15.164.165.52.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      31.121.18.2.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      31.121.18.2.in-addr.arpa
                                      IN PTR
                                      Response
                                      31.121.18.2.in-addr.arpa
                                      IN PTR
                                      a2-18-121-31deploystaticakamaitechnologiescom
                                    • flag-us
                                      DNS
                                      82.90.14.23.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      82.90.14.23.in-addr.arpa
                                      IN PTR
                                      Response
                                      82.90.14.23.in-addr.arpa
                                      IN PTR
                                      a23-14-90-82deploystaticakamaitechnologiescom
                                    • flag-us
                                      DNS
                                      80.90.14.23.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      80.90.14.23.in-addr.arpa
                                      IN PTR
                                      Response
                                      80.90.14.23.in-addr.arpa
                                      IN PTR
                                      a23-14-90-80deploystaticakamaitechnologiescom
                                    • flag-us
                                      DNS
                                      14.227.111.52.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      14.227.111.52.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      43.58.199.20.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      43.58.199.20.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      tse1.mm.bing.net
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      tse1.mm.bing.net
                                      IN A
                                      Response
                                      tse1.mm.bing.net
                                      IN CNAME
                                      mm-mm.bing.net.trafficmanager.net
                                      mm-mm.bing.net.trafficmanager.net
                                      IN CNAME
                                      ax-0001.ax-msedge.net
                                      ax-0001.ax-msedge.net
                                      IN A
                                      150.171.27.10
                                      ax-0001.ax-msedge.net
                                      IN A
                                      150.171.28.10
                                    • flag-us
                                      GET
                                      https://tse1.mm.bing.net/th?id=OADD2.10239351692308_1QYA5IZ7RRGGSDH4Z&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                      Remote address:
                                      150.171.27.10:443
                                      Request
                                      GET /th?id=OADD2.10239351692308_1QYA5IZ7RRGGSDH4Z&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                      host: tse1.mm.bing.net
                                      accept: */*
                                      accept-encoding: gzip, deflate, br
                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                      Response
                                      HTTP/2.0 200
                                      cache-control: public, max-age=2592000
                                      content-length: 637660
                                      content-type: image/jpeg
                                      x-cache: TCP_HIT
                                      access-control-allow-origin: *
                                      access-control-allow-headers: *
                                      access-control-allow-methods: GET, POST, OPTIONS
                                      timing-allow-origin: *
                                      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 4F883949A1574D7AB0C82BE71626C1B2 Ref B: LON04EDGE0720 Ref C: 2024-07-01T20:13:34Z
                                      date: Mon, 01 Jul 2024 20:13:34 GMT
                                    • flag-us
                                      GET
                                      https://tse1.mm.bing.net/th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                      Remote address:
                                      150.171.27.10:443
                                      Request
                                      GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                      host: tse1.mm.bing.net
                                      accept: */*
                                      accept-encoding: gzip, deflate, br
                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                      Response
                                      HTTP/2.0 200
                                      cache-control: public, max-age=2592000
                                      content-length: 634564
                                      content-type: image/jpeg
                                      x-cache: TCP_HIT
                                      access-control-allow-origin: *
                                      access-control-allow-headers: *
                                      access-control-allow-methods: GET, POST, OPTIONS
                                      timing-allow-origin: *
                                      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: E0F4B70BC53E439780D032171628B857 Ref B: LON04EDGE0720 Ref C: 2024-07-01T20:13:34Z
                                      date: Mon, 01 Jul 2024 20:13:34 GMT
                                    • flag-us
                                      GET
                                      https://tse1.mm.bing.net/th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                      Remote address:
                                      150.171.27.10:443
                                      Request
                                      GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                      host: tse1.mm.bing.net
                                      accept: */*
                                      accept-encoding: gzip, deflate, br
                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                      Response
                                      HTTP/2.0 200
                                      cache-control: public, max-age=2592000
                                      content-length: 276211
                                      content-type: image/jpeg
                                      x-cache: TCP_HIT
                                      access-control-allow-origin: *
                                      access-control-allow-headers: *
                                      access-control-allow-methods: GET, POST, OPTIONS
                                      timing-allow-origin: *
                                      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 8A6E0FAFEA8142B083D46BC48736A815 Ref B: LON04EDGE0720 Ref C: 2024-07-01T20:13:34Z
                                      date: Mon, 01 Jul 2024 20:13:34 GMT
                                    • flag-us
                                      GET
                                      https://tse1.mm.bing.net/th?id=OADD2.10239351692309_12E985FV6AZCRM3HV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                      Remote address:
                                      150.171.27.10:443
                                      Request
                                      GET /th?id=OADD2.10239351692309_12E985FV6AZCRM3HV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                      host: tse1.mm.bing.net
                                      accept: */*
                                      accept-encoding: gzip, deflate, br
                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                      Response
                                      HTTP/2.0 200
                                      cache-control: public, max-age=2592000
                                      content-length: 383394
                                      content-type: image/jpeg
                                      x-cache: TCP_HIT
                                      access-control-allow-origin: *
                                      access-control-allow-headers: *
                                      access-control-allow-methods: GET, POST, OPTIONS
                                      timing-allow-origin: *
                                      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 873E2B2DE0E94B97A5B6A6527A7D6B9A Ref B: LON04EDGE0720 Ref C: 2024-07-01T20:13:34Z
                                      date: Mon, 01 Jul 2024 20:13:34 GMT
                                    • flag-us
                                      DNS
                                      10.27.171.150.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      10.27.171.150.in-addr.arpa
                                      IN PTR
                                      Response
                                    • flag-us
                                      DNS
                                      3.173.189.20.in-addr.arpa
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      3.173.189.20.in-addr.arpa
                                      IN PTR
                                      Response
                                    • 13.107.21.237:443
                                      https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8MT35ORLvHd03ImQofxCG_zVUCUxtkI1clct017HOkcrxLuoBQcJ0xCVGD_01gV36uPPM0tPI1Cth--1s9m6go4U55e1H5Yp4VkBWnEQFtr7CP15MMcSAATuU2aY96pqHHAZbf1lyTOb2iencz97ugU8aLB6DyJPxVFSjEYEmAlarFA6_%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D3c30fc32ba061d2282d19a5a1e83d0de&TIME=20240611T192557Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407&muid=82EA48EC8031841EBBBB3EE75126D09B
                                      tls, http2
                                      backgroundTaskHost.exe
                                      2.5kB
                                       9.1kB
                                       19
                                      17

                                      HTTP Request

                                      GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8MT35ORLvHd03ImQofxCG_zVUCUxtkI1clct017HOkcrxLuoBQcJ0xCVGD_01gV36uPPM0tPI1Cth--1s9m6go4U55e1H5Yp4VkBWnEQFtr7CP15MMcSAATuU2aY96pqHHAZbf1lyTOb2iencz97ugU8aLB6DyJPxVFSjEYEmAlarFA6_%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D3c30fc32ba061d2282d19a5a1e83d0de&TIME=20240611T192557Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407&muid=82EA48EC8031841EBBBB3EE75126D09B

                                      HTTP Response

                                      204

                                      HTTP Request

                                      GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8MT35ORLvHd03ImQofxCG_zVUCUxtkI1clct017HOkcrxLuoBQcJ0xCVGD_01gV36uPPM0tPI1Cth--1s9m6go4U55e1H5Yp4VkBWnEQFtr7CP15MMcSAATuU2aY96pqHHAZbf1lyTOb2iencz97ugU8aLB6DyJPxVFSjEYEmAlarFA6_%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D3c30fc32ba061d2282d19a5a1e83d0de&TIME=20240611T192557Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407&muid=82EA48EC8031841EBBBB3EE75126D09B

                                      HTTP Response

                                      204
                                    • 88.221.83.217:443
                                      https://www.bing.com/aes/c.gif?RG=57b3a8eabb3d481ca920ba845f1afd70&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T192557Z&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407
                                      tls, http2
                                      backgroundTaskHost.exe
                                      1.4kB
                                       5.4kB
                                       16
                                      15

                                      HTTP Request

                                      GET https://www.bing.com/aes/c.gif?RG=57b3a8eabb3d481ca920ba845f1afd70&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T192557Z&adUnitId=11730597&localId=w:82EA48EC-8031-841E-BBBB-3EE75126D09B&deviceId=6896198597119407

                                      HTTP Response

                                      200
                                    • 150.171.27.10:443
                                      tse1.mm.bing.net
                                      tls, http2
                                      1.2kB
                                       6.9kB
                                       15
                                      13
                                    • 150.171.27.10:443
                                      tse1.mm.bing.net
                                      tls, http2
                                      1.2kB
                                       6.9kB
                                       15
                                      13
                                    • 150.171.27.10:443
                                      https://tse1.mm.bing.net/th?id=OADD2.10239351692309_12E985FV6AZCRM3HV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                      tls, http2
                                      67.8kB
                                       2.0MB
                                       1450
                                      1448

                                      HTTP Request

                                      GET https://tse1.mm.bing.net/th?id=OADD2.10239351692308_1QYA5IZ7RRGGSDH4Z&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                      HTTP Request

                                      GET https://tse1.mm.bing.net/th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                      HTTP Request

                                      GET https://tse1.mm.bing.net/th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                      HTTP Request

                                      GET https://tse1.mm.bing.net/th?id=OADD2.10239351692309_12E985FV6AZCRM3HV&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                      HTTP Response

                                      200

                                      HTTP Response

                                      200

                                      HTTP Response

                                      200

                                      HTTP Response

                                      200
                                    • 150.171.27.10:443
                                      tse1.mm.bing.net
                                      tls, http2
                                      1.2kB
                                       6.9kB
                                       15
                                      13
                                    • 8.8.8.8:53
                                      8.8.8.8.in-addr.arpa
                                      dns
                                      66 B
                                       90 B
                                       1
                                      1

                                      DNS Request

                                      8.8.8.8.in-addr.arpa

                                    • 8.8.8.8:53
                                      241.150.49.20.in-addr.arpa
                                      dns
                                      72 B
                                       158 B
                                       1
                                      1

                                      DNS Request

                                      241.150.49.20.in-addr.arpa

                                    • 8.8.8.8:53
                                      172.214.232.199.in-addr.arpa
                                      dns
                                      74 B
                                       128 B
                                       1
                                      1

                                      DNS Request

                                      172.214.232.199.in-addr.arpa

                                    • 8.8.8.8:53
                                      68.32.126.40.in-addr.arpa
                                      dns
                                      71 B
                                       157 B
                                       1
                                      1

                                      DNS Request

                                      68.32.126.40.in-addr.arpa

                                    • 8.8.8.8:53
                                      55.36.223.20.in-addr.arpa
                                      dns
                                      71 B
                                       157 B
                                       1
                                      1

                                      DNS Request

                                      55.36.223.20.in-addr.arpa

                                    • 8.8.8.8:53
                                      g.bing.com
                                      dns
                                      56 B
                                       151 B
                                       1
                                      1

                                      DNS Request

                                      g.bing.com

                                      DNS Response

                                      13.107.21.237
                                      204.79.197.237

                                    • 8.8.8.8:53
                                      237.21.107.13.in-addr.arpa
                                      dns
                                      72 B
                                       158 B
                                       1
                                      1

                                      DNS Request

                                      237.21.107.13.in-addr.arpa

                                    • 8.8.8.8:53
                                      217.83.221.88.in-addr.arpa
                                      dns
                                      72 B
                                       137 B
                                       1
                                      1

                                      DNS Request

                                      217.83.221.88.in-addr.arpa

                                    • 8.8.8.8:53
                                      104.219.191.52.in-addr.arpa
                                      dns
                                      73 B
                                       147 B
                                       1
                                      1

                                      DNS Request

                                      104.219.191.52.in-addr.arpa

                                    • 8.8.8.8:53
                                      58.55.71.13.in-addr.arpa
                                      dns
                                      70 B
                                       144 B
                                       1
                                      1

                                      DNS Request

                                      58.55.71.13.in-addr.arpa

                                    • 8.8.8.8:53
                                      183.59.114.20.in-addr.arpa
                                      dns
                                      72 B
                                       158 B
                                       1
                                      1

                                      DNS Request

                                      183.59.114.20.in-addr.arpa

                                    • 8.8.8.8:53
                                      15.164.165.52.in-addr.arpa
                                      dns
                                      72 B
                                       146 B
                                       1
                                      1

                                      DNS Request

                                      15.164.165.52.in-addr.arpa

                                    • 8.8.8.8:53
                                      31.121.18.2.in-addr.arpa
                                      dns
                                      70 B
                                       133 B
                                       1
                                      1

                                      DNS Request

                                      31.121.18.2.in-addr.arpa

                                    • 8.8.8.8:53
                                      82.90.14.23.in-addr.arpa
                                      dns
                                      70 B
                                       133 B
                                       1
                                      1

                                      DNS Request

                                      82.90.14.23.in-addr.arpa

                                    • 8.8.8.8:53
                                      80.90.14.23.in-addr.arpa
                                      dns
                                      70 B
                                       133 B
                                       1
                                      1

                                      DNS Request

                                      80.90.14.23.in-addr.arpa

                                    • 8.8.8.8:53
                                      14.227.111.52.in-addr.arpa
                                      dns
                                      72 B
                                       158 B
                                       1
                                      1

                                      DNS Request

                                      14.227.111.52.in-addr.arpa

                                    • 8.8.8.8:53
                                      43.58.199.20.in-addr.arpa
                                      dns
                                      71 B
                                       157 B
                                       1
                                      1

                                      DNS Request

                                      43.58.199.20.in-addr.arpa

                                    • 8.8.8.8:53
                                      tse1.mm.bing.net
                                      dns
                                      62 B
                                       170 B
                                       1
                                      1

                                      DNS Request

                                      tse1.mm.bing.net

                                      DNS Response

                                      150.171.27.10
                                      150.171.28.10

                                    • 8.8.8.8:53
                                      10.27.171.150.in-addr.arpa
                                      dns
                                      72 B
                                       158 B
                                       1
                                      1

                                      DNS Request

                                      10.27.171.150.in-addr.arpa

                                    • 8.8.8.8:53
                                      3.173.189.20.in-addr.arpa
                                      dns
                                      71 B
                                       157 B
                                       1
                                      1

                                      DNS Request

                                      3.173.189.20.in-addr.arpa

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • memory/1280-0-0x0000000000400000-0x0000000000571000-memory.dmp

                                      Filesize

                                      1.4MB

                                      Download

                                    • memory/1280-1-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-4-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-8-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-6-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-7-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-17-0x00000000008F0000-0x00000000008F2000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/1280-19-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-18-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-16-0x00000000008A0000-0x00000000008B1000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/1280-14-0x0000000002610000-0x0000000002611000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/1280-13-0x00000000008F0000-0x00000000008F2000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/1280-12-0x00000000008A0000-0x00000000008B1000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/1280-11-0x00000000008A0000-0x00000000008B1000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/1280-10-0x00000000008A0000-0x00000000008B1000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/1280-9-0x00000000008A0000-0x00000000008B1000-memory.dmp

                                      Filesize

                                      68KB

                                      Download

                                    • memory/1280-5-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-15-0x00000000008F0000-0x00000000008F2000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/1280-3-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-20-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-22-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-21-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-32-0x00000000027C0000-0x000000000384E000-memory.dmp

                                      Filesize

                                      16.6MB

                                      Download

                                    • memory/1280-41-0x0000000000400000-0x0000000000571000-memory.dmp

                                      Filesize

                                      1.4MB

                                      Download

                                    We care about your privacy.

                                    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.