sality | 5b2867a6400555f776c50def66004cf71857d35cb3b4d0371f20c2898ba6c68a

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e57a095.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57a325.exe

Windows security bypass 2 TTPs 12 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57a325.exe

Executes dropped EXE 3 IoCs

pid	Process
5092	e57a095.exe
4168	e57a325.exe
2108	e57bbfd.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5092-9-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/5092-10-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/5092-16-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/5092-22-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/5092-14-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/5092-15-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/5092-13-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/5092-12-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/5092-11-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/5092-8-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/5092-53-0x00000000007A0000-0x000000000185A000-memory.dmp	upx
behavioral2/memory/4168-78-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-77-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-75-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-85-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-84-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-76-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-72-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-71-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-70-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-68-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-73-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx
behavioral2/memory/4168-74-0x0000000000BA0000-0x0000000001C5A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57a325.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e57a325.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57a325.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57a325.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57a325.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	e57a095.exe
File created	C:\Windows\e57f1e2	e57a325.exe
File created	C:\Windows\e57a20c	e57a095.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e57bbfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e57a095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e57a325.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5092	e57a095.exe
5092	e57a095.exe
5092	e57a095.exe
5092	e57a095.exe
4168	e57a325.exe
4168	e57a325.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe
Token: SeDebugPrivilege	5092	e57a095.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3268	4072	rundll32.exe	84
PID 4072 wrote to memory of 3268	4072	rundll32.exe	84
PID 4072 wrote to memory of 3268	4072	rundll32.exe	84
PID 3268 wrote to memory of 5092	3268	rundll32.exe	85
PID 3268 wrote to memory of 5092	3268	rundll32.exe	85
PID 3268 wrote to memory of 5092	3268	rundll32.exe	85
PID 5092 wrote to memory of 788	5092	e57a095.exe	8
PID 5092 wrote to memory of 796	5092	e57a095.exe	9
PID 5092 wrote to memory of 380	5092	e57a095.exe	13
PID 5092 wrote to memory of 2552	5092	e57a095.exe	44
PID 5092 wrote to memory of 2616	5092	e57a095.exe	45
PID 5092 wrote to memory of 3064	5092	e57a095.exe	53
PID 5092 wrote to memory of 3492	5092	e57a095.exe	56
PID 5092 wrote to memory of 3680	5092	e57a095.exe	57
PID 5092 wrote to memory of 3852	5092	e57a095.exe	58
PID 5092 wrote to memory of 3944	5092	e57a095.exe	59
PID 5092 wrote to memory of 4008	5092	e57a095.exe	60
PID 5092 wrote to memory of 1064	5092	e57a095.exe	61
PID 5092 wrote to memory of 2340	5092	e57a095.exe	62
PID 5092 wrote to memory of 1048	5092	e57a095.exe	74
PID 5092 wrote to memory of 628	5092	e57a095.exe	76
PID 5092 wrote to memory of 3464	5092	e57a095.exe	81
PID 5092 wrote to memory of 4140	5092	e57a095.exe	82
PID 5092 wrote to memory of 4072	5092	e57a095.exe	83
PID 5092 wrote to memory of 3268	5092	e57a095.exe	84
PID 5092 wrote to memory of 3268	5092	e57a095.exe	84
PID 3268 wrote to memory of 4168	3268	rundll32.exe	86
PID 3268 wrote to memory of 4168	3268	rundll32.exe	86
PID 3268 wrote to memory of 4168	3268	rundll32.exe	86
PID 3268 wrote to memory of 2108	3268	rundll32.exe	94
PID 3268 wrote to memory of 2108	3268	rundll32.exe	94
PID 3268 wrote to memory of 2108	3268	rundll32.exe	94
PID 5092 wrote to memory of 788	5092	e57a095.exe	8
PID 5092 wrote to memory of 796	5092	e57a095.exe	9
PID 5092 wrote to memory of 380	5092	e57a095.exe	13
PID 5092 wrote to memory of 2552	5092	e57a095.exe	44
PID 5092 wrote to memory of 2616	5092	e57a095.exe	45
PID 5092 wrote to memory of 3064	5092	e57a095.exe	53
PID 5092 wrote to memory of 3492	5092	e57a095.exe	56
PID 5092 wrote to memory of 3680	5092	e57a095.exe	57
PID 5092 wrote to memory of 3852	5092	e57a095.exe	58
PID 5092 wrote to memory of 3944	5092	e57a095.exe	59
PID 5092 wrote to memory of 4008	5092	e57a095.exe	60
PID 5092 wrote to memory of 1064	5092	e57a095.exe	61
PID 5092 wrote to memory of 2340	5092	e57a095.exe	62
PID 5092 wrote to memory of 1048	5092	e57a095.exe	74
PID 5092 wrote to memory of 628	5092	e57a095.exe	76
PID 5092 wrote to memory of 3464	5092	e57a095.exe	81
PID 5092 wrote to memory of 4168	5092	e57a095.exe	86
PID 5092 wrote to memory of 4168	5092	e57a095.exe	86
PID 5092 wrote to memory of 1860	5092	e57a095.exe	88
PID 5092 wrote to memory of 5028	5092	e57a095.exe	89
PID 5092 wrote to memory of 2108	5092	e57a095.exe	94
PID 5092 wrote to memory of 2108	5092	e57a095.exe	94
PID 4168 wrote to memory of 788	4168	e57a325.exe	8
PID 4168 wrote to memory of 796	4168	e57a325.exe	9
PID 4168 wrote to memory of 380	4168	e57a325.exe	13
PID 4168 wrote to memory of 2552	4168	e57a325.exe	44
PID 4168 wrote to memory of 2616	4168	e57a325.exe	45
PID 4168 wrote to memory of 3064	4168	e57a325.exe	53
PID 4168 wrote to memory of 3492	4168	e57a325.exe	56
PID 4168 wrote to memory of 3680	4168	e57a325.exe	57
PID 4168 wrote to memory of 3852	4168	e57a325.exe	58
PID 4168 wrote to memory of 3944	4168	e57a325.exe	59

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57a095.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57a325.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:380

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2616

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3064

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3492
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7e4f9b338f634e9818ab8ccb1a12e30N.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e7e4f9b338f634e9818ab8ccb1a12e30N.dll,#1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\e57a095.exe
      C:\Users\Admin\AppData\Local\Temp\e57a095.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\e57a325.exe
      C:\Users\Admin\AppData\Local\Temp\e57a325.exe
      4⤵
      Modifies firewall policy service
      UAC bypass
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\e57bbfd.exe
      C:\Users\Admin\AppData\Local\Temp\e57bbfd.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3680

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3852

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3944

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4008

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1064

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2340

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1048

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:628

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3464

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4140

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1860

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5028

Network

DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.dual-a-0034.a-msedge.net

g-bing-com.dual-a-0034.a-msedge.net

IN CNAME

dual-a-0034.a-msedge.net

dual-a-0034.a-msedge.net

IN A

13.107.21.237

dual-a-0034.a-msedge.net

IN A

204.79.197.237
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed415eac34ad4411b17e033ab2ae5c7a&localId=w:82828431-2DDB-D3A4-0A67-5CF56E102AD4&deviceId=6755468654845740&anid=

backgroundTaskHost.exe

Remote address:

13.107.21.237:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed415eac34ad4411b17e033ab2ae5c7a&localId=w:82828431-2DDB-D3A4-0A67-5CF56E102AD4&deviceId=6755468654845740&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=368F07C322586C4F31DF1319237F6D7D; domain=.bing.com; expires=Sun, 07-Sep-2025 17:56:33 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 527FC0AC67BD406BB8C64431E4E87261 Ref B: LON04EDGE0712 Ref C: 2024-08-13T17:56:33Z
date: Tue, 13 Aug 2024 17:56:32 GMT
GET

https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ed415eac34ad4411b17e033ab2ae5c7a&localId=w:82828431-2DDB-D3A4-0A67-5CF56E102AD4&deviceId=6755468654845740&anid=

backgroundTaskHost.exe

Remote address:

13.107.21.237:443

Request

GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ed415eac34ad4411b17e033ab2ae5c7a&localId=w:82828431-2DDB-D3A4-0A67-5CF56E102AD4&deviceId=6755468654845740&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=368F07C322586C4F31DF1319237F6D7D

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=f9AeLTE4UZhiiLpIN4ZY9wV_VTjMx2BNE5q3kEXrWOU; domain=.bing.com; expires=Sun, 07-Sep-2025 17:56:33 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 42D58B1D8F0D46609C6B2A61B73EACC8 Ref B: LON04EDGE0712 Ref C: 2024-08-13T17:56:33Z
date: Tue, 13 Aug 2024 17:56:32 GMT
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed415eac34ad4411b17e033ab2ae5c7a&localId=w:82828431-2DDB-D3A4-0A67-5CF56E102AD4&deviceId=6755468654845740&anid=

backgroundTaskHost.exe

Remote address:

13.107.21.237:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed415eac34ad4411b17e033ab2ae5c7a&localId=w:82828431-2DDB-D3A4-0A67-5CF56E102AD4&deviceId=6755468654845740&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=368F07C322586C4F31DF1319237F6D7D; MSPTC=f9AeLTE4UZhiiLpIN4ZY9wV_VTjMx2BNE5q3kEXrWOU

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1E758085424842848726735AD9A08796 Ref B: LON04EDGE0712 Ref C: 2024-08-13T17:56:33Z
date: Tue, 13 Aug 2024 17:56:32 GMT
DNS

75.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

75.159.190.20.in-addr.arpa

IN PTR

Response
DNS

237.21.107.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

237.21.107.13.in-addr.arpa

IN PTR

Response
DNS

240.143.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.143.123.92.in-addr.arpa

IN PTR

Response

240.143.123.92.in-addr.arpa

IN PTR

a92-123-143-240deploystaticakamaitechnologiescom
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

154.239.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.239.44.20.in-addr.arpa

IN PTR

Response
DNS

55.36.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

55.36.223.20.in-addr.arpa

IN PTR

Response
DNS

28.118.140.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.118.140.52.in-addr.arpa

IN PTR

Response
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR
DNS

28.118.140.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.118.140.52.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.28.10

ax-0001.ax-msedge.net

IN A

150.171.27.10
GET

https://tse1.mm.bing.net/th?id=OADD2.10239360432890_1TOC5U5IB565A9QI0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239360432890_1TOC5U5IB565A9QI0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 622808
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 350C96F12B7C40F19F61FC3BBBEC0483 Ref B: LON04EDGE1221 Ref C: 2024-08-13T17:58:23Z
date: Tue, 13 Aug 2024 17:58:22 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301078_1O81E4QM35DM2EN4A&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239317301078_1O81E4QM35DM2EN4A&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 695371
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E39AD8B69E0448C8B0DE07D13B090F92 Ref B: LON04EDGE1221 Ref C: 2024-08-13T17:58:23Z
date: Tue, 13 Aug 2024 17:58:22 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239360432892_19VCX0OIIPQAUNJ24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239360432892_19VCX0OIIPQAUNJ24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 747785
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 317CA7E1622F44868FBEEE98F1FAD0D9 Ref B: LON04EDGE1221 Ref C: 2024-08-13T17:58:23Z
date: Tue, 13 Aug 2024 17:58:22 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418535_1J3FI1BHYFKNLDX7C&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239340418535_1J3FI1BHYFKNLDX7C&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 248362
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D7A5FC09920141B2A54F9FDC9DC6BDAA Ref B: LON04EDGE1221 Ref C: 2024-08-13T17:58:23Z
date: Tue, 13 Aug 2024 17:58:22 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418536_1RXQC5FWNJZBHVB3M&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239340418536_1RXQC5FWNJZBHVB3M&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 383560
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 73C8D0B7038D4C3A952DA23B51BDCB23 Ref B: LON04EDGE1221 Ref C: 2024-08-13T17:58:23Z
date: Tue, 13 Aug 2024 17:58:23 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301511_14RJSOYL5IFIBQQUL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239317301511_14RJSOYL5IFIBQQUL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 625518
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 662E3460B65B4BF98B4B0892632218CA Ref B: LON04EDGE1221 Ref C: 2024-08-13T17:58:24Z
date: Tue, 13 Aug 2024 17:58:23 GMT
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response

13.107.21.237:443

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed415eac34ad4411b17e033ab2ae5c7a&localId=w:82828431-2DDB-D3A4-0A67-5CF56E102AD4&deviceId=6755468654845740&anid=

tls, http2

backgroundTaskHost.exe

2.0kB
9.3kB
22
18

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed415eac34ad4411b17e033ab2ae5c7a&localId=w:82828431-2DDB-D3A4-0A67-5CF56E102AD4&deviceId=6755468654845740&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ed415eac34ad4411b17e033ab2ae5c7a&localId=w:82828431-2DDB-D3A4-0A67-5CF56E102AD4&deviceId=6755468654845740&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed415eac34ad4411b17e033ab2ae5c7a&localId=w:82828431-2DDB-D3A4-0A67-5CF56E102AD4&deviceId=6755468654845740&anid=

HTTP Response

204
52.111.243.31:443

322 B
7
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
16
13
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
16
14
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.2kB
7.7kB
16
12
150.171.28.10:443

https://tse1.mm.bing.net/th?id=OADD2.10239317301511_14RJSOYL5IFIBQQUL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

tls, http2

119.8kB
3.4MB
2511
2502

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239360432890_1TOC5U5IB565A9QI0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301078_1O81E4QM35DM2EN4A&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239360432892_19VCX0OIIPQAUNJ24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418535_1J3FI1BHYFKNLDX7C&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418536_1RXQC5FWNJZBHVB3M&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301511_14RJSOYL5IFIBQQUL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.6kB
7.3kB
18
13

8.8.8.8:53

g.bing.com

dns

56 B
151 B
1
1

DNS Request

g.bing.com

DNS Response

13.107.21.237

204.79.197.237
8.8.8.8:53

75.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

75.159.190.20.in-addr.arpa
8.8.8.8:53

237.21.107.13.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

237.21.107.13.in-addr.arpa
8.8.8.8:53

240.143.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

240.143.123.92.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

154.239.44.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

154.239.44.20.in-addr.arpa
8.8.8.8:53

55.36.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

55.36.223.20.in-addr.arpa
8.8.8.8:53

28.118.140.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

28.118.140.52.in-addr.arpa
8.8.8.8:53

26.165.165.52.in-addr.arpa

dns

360 B
5

DNS Request

26.165.165.52.in-addr.arpa

DNS Request

26.165.165.52.in-addr.arpa

DNS Request

26.165.165.52.in-addr.arpa

DNS Request

26.165.165.52.in-addr.arpa

DNS Request

26.165.165.52.in-addr.arpa
8.8.8.8:53

28.118.140.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

28.118.140.52.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

219 B
144 B
3
1

DNS Request

240.221.184.93.in-addr.arpa

DNS Request

240.221.184.93.in-addr.arpa

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

62 B
170 B
1
1

DNS Request

tse1.mm.bing.net

DNS Response

150.171.28.10

150.171.27.10
8.8.8.8:53

19.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry