Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

URLScan

urlscan

1

https://guiwow.lanzo...

windows10-2004-x64

1

Analysis

  • max time kernel
    118s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2023, 07:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://guiwow.lanzoux.com/ivbCSwzfhhg

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://guiwow.lanzoux.com/ivbCSwzfhhg
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff864f946f8,0x7ff864f94708,0x7ff864f94718
      2⤵
        PID:5088
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        2⤵
          PID:2376
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:900
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
          2⤵
            PID:1296
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
            2⤵
              PID:4920
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:1756
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
                2⤵
                  PID:4180
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3948
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
                  2⤵
                    PID:1828
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                    2⤵
                      PID:2696
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                      2⤵
                        PID:4224
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
                        2⤵
                          PID:4764
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,9632715399740289158,11827995859511578928,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4948 /prefetch:8
                          2⤵
                            PID:2920
                        • C:\Windows\system32\taskmgr.exe
                          "C:\Windows\system32\taskmgr.exe" /4
                          1⤵
                          • Checks SCSI registry key(s)
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:4812
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3796
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4200

                            Network

                            • flag-us
                              DNS
                              8.8.8.8.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              8.8.8.8.in-addr.arpa
                              IN PTR
                              Response
                              8.8.8.8.in-addr.arpa
                              IN PTR
                              dnsgoogle
                            • flag-us
                              DNS
                              assets.msn.com
                              Remote address:
                              8.8.8.8:53
                              Request
                              assets.msn.com
                              IN A
                              Response
                              assets.msn.com
                              IN CNAME
                              assets.msn.com.edgekey.net
                              assets.msn.com.edgekey.net
                              IN CNAME
                              e28578.d.akamaiedge.net
                              e28578.d.akamaiedge.net
                              IN A
                              2.22.54.187
                              e28578.d.akamaiedge.net
                              IN A
                              2.22.54.144
                            • flag-us
                              DNS
                              187.54.22.2.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              187.54.22.2.in-addr.arpa
                              IN PTR
                              Response
                              187.54.22.2.in-addr.arpa
                              IN PTR
                              a2-22-54-187deploystaticakamaitechnologiescom
                            • flag-us
                              DNS
                              guiwow.lanzoux.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              guiwow.lanzoux.com
                              IN A
                              Response
                              guiwow.lanzoux.com
                              IN CNAME
                              088af02c.lanzoux.com.cdn.dnsv1.com.cn
                              088af02c.lanzoux.com.cdn.dnsv1.com.cn
                              IN CNAME
                              cpb9pmt7.slt.sched.tdnsv8.com
                              cpb9pmt7.slt.sched.tdnsv8.com
                              IN A
                              116.153.64.158
                              cpb9pmt7.slt.sched.tdnsv8.com
                              IN A
                              119.188.86.194
                              cpb9pmt7.slt.sched.tdnsv8.com
                              IN A
                              116.172.148.7
                              cpb9pmt7.slt.sched.tdnsv8.com
                              IN A
                              42.236.89.185
                              cpb9pmt7.slt.sched.tdnsv8.com
                              IN A
                              116.163.24.195
                            • flag-us
                              DNS
                              95.221.229.192.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              95.221.229.192.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              57.169.31.20.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              57.169.31.20.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              17.160.190.20.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              17.160.190.20.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              assets.woozooo.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              assets.woozooo.com
                              IN A
                              Response
                              assets.woozooo.com
                              IN CNAME
                              assets.woozooo.com.a.bdydns.com
                              assets.woozooo.com.a.bdydns.com
                              IN CNAME
                              opencdnspy.jomodns.com
                              opencdnspy.jomodns.com
                              IN A
                              219.151.25.35
                              opencdnspy.jomodns.com
                              IN A
                              182.106.158.35
                              opencdnspy.jomodns.com
                              IN A
                              182.107.80.35
                              opencdnspy.jomodns.com
                              IN A
                              182.140.225.35
                              opencdnspy.jomodns.com
                              IN A
                              183.60.219.35
                              opencdnspy.jomodns.com
                              IN A
                              182.84.110.35
                              opencdnspy.jomodns.com
                              IN A
                              220.169.152.35
                              opencdnspy.jomodns.com
                              IN A
                              125.64.104.35
                              opencdnspy.jomodns.com
                              IN A
                              106.117.216.35
                              opencdnspy.jomodns.com
                              IN A
                              111.174.1.35
                            • flag-cn
                              GET
                              https://assets.woozooo.com/assets/includes/js/jquery.js
                              msedge.exe
                              Remote address:
                              219.151.25.35:443
                              Request
                              GET /assets/includes/js/jquery.js HTTP/2.0
                              host: assets.woozooo.com
                              sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
                              dnt: 1
                              sec-ch-ua-mobile: ?0
                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                              accept: */*
                              sec-fetch-site: cross-site
                              sec-fetch-mode: no-cors
                              sec-fetch-dest: script
                              referer: https://guiwow.lanzoux.com/
                              accept-encoding: gzip, deflate, br
                              accept-language: en-US,en;q=0.9
                              Response
                              HTTP/2.0 200
                              server: JSP3/2.0.14
                              date: Sun, 16 Jul 2023 07:48:34 GMT
                              content-type: application/x-javascript
                              expires: Mon, 03 Jul 2023 22:09:44 GMT
                              last-modified: Thu, 19 Apr 2012 00:31:14 GMT
                              etag: "4f8f5cd2-7943"
                              cache-control: max-age=43200
                              content-encoding: br
                              age: 15158
                              accept-ranges: bytes
                              ohc-global-saved-time: Mon, 03 Jul 2023 10:09:44 GMT
                              ohc-cache-hit: gy2ct70 [2], qdix70 [2]
                              ohc-file-size: 31043
                              x-cache-status: HIT
                            • flag-cn
                              GET
                              https://assets.woozooo.com/assets/img/qrcode.min.js
                              msedge.exe
                              Remote address:
                              219.151.25.35:443
                              Request
                              GET /assets/img/qrcode.min.js HTTP/2.0
                              host: assets.woozooo.com
                              sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
                              dnt: 1
                              sec-ch-ua-mobile: ?0
                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                              accept: */*
                              sec-fetch-site: cross-site
                              sec-fetch-mode: no-cors
                              sec-fetch-dest: script
                              referer: https://guiwow.lanzoux.com/
                              accept-encoding: gzip, deflate, br
                              accept-language: en-US,en;q=0.9
                              Response
                              HTTP/2.0 200
                              server: JSP3/2.0.14
                              date: Sun, 16 Jul 2023 07:48:34 GMT
                              content-type: application/x-javascript
                              expires: Mon, 03 Jul 2023 22:08:55 GMT
                              last-modified: Sun, 16 Apr 2017 01:38:50 GMT
                              etag: "58f2cb2a-4dd7"
                              cache-control: max-age=43200
                              content-encoding: br
                              age: 166861
                              accept-ranges: bytes
                              ohc-global-saved-time: Mon, 03 Jul 2023 10:08:55 GMT
                              ohc-cache-hit: gy2ct62 [2], suzix128 [2]
                              ohc-file-size: 19927
                              x-cache-status: HIT
                            • flag-cn
                              GET
                              https://assets.woozooo.com/assets/images/type/jar_max.gif
                              msedge.exe
                              Remote address:
                              219.151.25.35:443
                              Request
                              GET /assets/images/type/jar_max.gif HTTP/2.0
                              host: assets.woozooo.com
                              sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
                              dnt: 1
                              sec-ch-ua-mobile: ?0
                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                              accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                              sec-fetch-site: cross-site
                              sec-fetch-mode: no-cors
                              sec-fetch-dest: image
                              referer: https://guiwow.lanzoux.com/
                              accept-encoding: gzip, deflate, br
                              accept-language: en-US,en;q=0.9
                              Response
                              HTTP/2.0 200
                              server: JSP3/2.0.14
                              date: Sun, 16 Jul 2023 07:48:35 GMT
                              content-type: image/gif
                              content-length: 9042
                              expires: Wed, 02 Aug 2023 10:16:35 GMT
                              last-modified: Sun, 28 Apr 2019 04:26:21 GMT
                              etag: "5cc52b6d-2352"
                              cache-control: max-age=2592000
                              age: 179426
                              accept-ranges: bytes
                              ohc-global-saved-time: Mon, 03 Jul 2023 10:16:35 GMT
                              ohc-cache-hit: gy2ct98 [4], bdix98 [2]
                              ohc-file-size: 9042
                              x-cache-status: HIT
                            • flag-cn
                              GET
                              https://assets.woozooo.com/assets/favicon.ico
                              msedge.exe
                              Remote address:
                              219.151.25.35:443
                              Request
                              GET /assets/favicon.ico HTTP/2.0
                              host: assets.woozooo.com
                              sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
                              dnt: 1
                              sec-ch-ua-mobile: ?0
                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                              accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                              sec-fetch-site: cross-site
                              sec-fetch-mode: no-cors
                              sec-fetch-dest: image
                              referer: https://guiwow.lanzoux.com/
                              accept-encoding: gzip, deflate, br
                              accept-language: en-US,en;q=0.9
                              Response
                              HTTP/2.0 200
                              server: JSP3/2.0.14
                              date: Sun, 16 Jul 2023 07:48:44 GMT
                              content-type: image/x-icon
                              last-modified: Wed, 03 Sep 2014 01:31:20 GMT
                              etag: "54066f68-47e"
                              content-encoding: br
                              age: 344537
                              accept-ranges: bytes
                              ohc-global-saved-time: Tue, 04 Jul 2023 00:55:19 GMT
                              ohc-cache-hit: gy2ct77 [2], xiangyix77 [2]
                              ohc-file-size: 1150
                              x-cache-status: HIT
                            • flag-us
                              DNS
                              158.64.153.116.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              158.64.153.116.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              35.25.151.219.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              35.25.151.219.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              158.240.127.40.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              158.240.127.40.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              statics.woozooo.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              statics.woozooo.com
                              IN A
                              Response
                              statics.woozooo.com
                              IN CNAME
                              statics.woozooo.com.a.bdydns.com
                              statics.woozooo.com.a.bdydns.com
                              IN CNAME
                              opencdnspy.jomodns.com
                              opencdnspy.jomodns.com
                              IN A
                              60.188.66.35
                              opencdnspy.jomodns.com
                              IN A
                              58.42.14.35
                              opencdnspy.jomodns.com
                              IN A
                              125.64.104.35
                              opencdnspy.jomodns.com
                              IN A
                              111.174.9.35
                              opencdnspy.jomodns.com
                              IN A
                              114.232.92.35
                              opencdnspy.jomodns.com
                              IN A
                              117.68.52.35
                              opencdnspy.jomodns.com
                              IN A
                              118.180.40.35
                              opencdnspy.jomodns.com
                              IN A
                              119.96.52.35
                              opencdnspy.jomodns.com
                              IN A
                              125.74.1.35
                              opencdnspy.jomodns.com
                              IN A
                              125.74.110.35
                            • flag-us
                              DNS
                              statics.woozooo.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              statics.woozooo.com
                              IN A
                              Response
                              statics.woozooo.com
                              IN CNAME
                              statics.woozooo.com.a.bdydns.com
                              statics.woozooo.com.a.bdydns.com
                              IN CNAME
                              opencdnspy.jomodns.com
                              opencdnspy.jomodns.com
                              IN A
                              175.6.53.35
                              opencdnspy.jomodns.com
                              IN A
                              111.177.8.35
                              opencdnspy.jomodns.com
                              IN A
                              113.105.172.35
                              opencdnspy.jomodns.com
                              IN A
                              123.244.94.35
                              opencdnspy.jomodns.com
                              IN A
                              124.238.241.35
                              opencdnspy.jomodns.com
                              IN A
                              171.107.86.35
                              opencdnspy.jomodns.com
                              IN A
                              113.219.142.35
                              opencdnspy.jomodns.com
                              IN A
                              180.97.64.35
                              opencdnspy.jomodns.com
                              IN A
                              180.97.66.35
                              opencdnspy.jomodns.com
                              IN A
                              180.97.198.35
                            • flag-cn
                              GET
                              https://statics.woozooo.com/img/bd.js
                              msedge.exe
                              Remote address:
                              60.188.66.35:443
                              Request
                              GET /img/bd.js HTTP/2.0
                              host: statics.woozooo.com
                              sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
                              dnt: 1
                              sec-ch-ua-mobile: ?0
                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                              accept: */*
                              sec-fetch-site: cross-site
                              sec-fetch-mode: no-cors
                              sec-fetch-dest: script
                              referer: https://guiwow.lanzoux.com/
                              accept-encoding: gzip, deflate, br
                              accept-language: en-US,en;q=0.9
                              Response
                              HTTP/2.0 200
                              server: JSP3/2.0.14
                              date: Sun, 16 Jul 2023 07:48:39 GMT
                              content-type: application/x-javascript
                              expires: Sat, 15 Jul 2023 18:48:06 GMT
                              last-modified: Tue, 24 May 2022 14:37:49 GMT
                              etag: "628cedbd-102"
                              cache-control: max-age=43200
                              content-encoding: br
                              age: 90030
                              accept-ranges: bytes
                              ohc-global-saved-time: Sat, 15 Jul 2023 06:48:06 GMT
                              ohc-cache-hit: jh2ct66 [2], bdix207 [2]
                              ohc-file-size: 258
                              x-cache-status: HIT
                            • flag-cn
                              GET
                              https://statics.woozooo.com/img/hm.js
                              msedge.exe
                              Remote address:
                              60.188.66.35:443
                              Request
                              GET /img/hm.js HTTP/2.0
                              host: statics.woozooo.com
                              sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
                              dnt: 1
                              sec-ch-ua-mobile: ?0
                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                              accept: */*
                              sec-fetch-site: cross-site
                              sec-fetch-mode: no-cors
                              sec-fetch-dest: script
                              referer: https://guiwow.lanzoux.com/
                              accept-encoding: gzip, deflate, br
                              accept-language: en-US,en;q=0.9
                              Response
                              HTTP/2.0 200
                              server: JSP3/2.0.14
                              date: Sun, 16 Jul 2023 07:48:39 GMT
                              content-type: application/x-javascript
                              expires: Wed, 12 Jul 2023 04:46:41 GMT
                              last-modified: Fri, 28 May 2021 15:00:34 GMT
                              etag: "60b10592-dc"
                              cache-control: max-age=43200
                              content-encoding: br
                              age: 399654
                              accept-ranges: bytes
                              ohc-global-saved-time: Tue, 11 Jul 2023 16:46:41 GMT
                              ohc-cache-hit: jh2ct85 [2], bdix85 [2]
                              ohc-file-size: 117
                              x-cache-status: HIT
                            • flag-us
                              DNS
                              hm.baidu.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              hm.baidu.com
                              IN A
                              Response
                              hm.baidu.com
                              IN CNAME
                              hm.e.shifen.com
                              hm.e.shifen.com
                              IN A
                              103.235.46.191
                            • flag-us
                              DNS
                              hm.baidu.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              hm.baidu.com
                              IN A
                              Response
                              hm.baidu.com
                              IN CNAME
                              hm.e.shifen.com
                              hm.e.shifen.com
                              IN A
                              103.235.46.191
                            • flag-us
                              DNS
                              hm.woozooo.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              hm.woozooo.com
                              IN A
                              Response
                              hm.woozooo.com
                              IN A
                              47.99.141.172
                            • flag-us
                              DNS
                              hm.woozooo.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              hm.woozooo.com
                              IN A
                              Response
                              hm.woozooo.com
                              IN A
                              47.99.141.172
                            • flag-us
                              DNS
                              35.66.188.60.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              35.66.188.60.in-addr.arpa
                              IN PTR
                              Response
                            • flag-cn
                              GET
                              https://hm.woozooo.com/hm.js?v=1.2
                              msedge.exe
                              Remote address:
                              47.99.141.172:443
                              Request
                              GET /hm.js?v=1.2 HTTP/2.0
                              host: hm.woozooo.com
                              sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
                              dnt: 1
                              sec-ch-ua-mobile: ?0
                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                              accept: */*
                              sec-fetch-site: cross-site
                              sec-fetch-mode: no-cors
                              sec-fetch-dest: script
                              referer: https://guiwow.lanzoux.com/
                              accept-encoding: gzip, deflate, br
                              accept-language: en-US,en;q=0.9
                              Response
                              HTTP/2.0 200
                              server: nginx/1.14.1
                              date: Sun, 16 Jul 2023 07:48:42 GMT
                              content-type: application/javascript
                              last-modified: Mon, 09 Jan 2023 10:16:01 GMT
                              vary: Accept-Encoding
                              etag: W/"63bbe961-2612"
                              expires: Tue, 15 Aug 2023 07:48:42 GMT
                              cache-control: max-age=2592000
                              content-encoding: gzip
                            • flag-cn
                              GET
                              https://hm.woozooo.com/st/stat.htm?id=82&r=&lg=en-us&ntime=none&czst_eid=1242102598-3821-&showp=1280x720&p=https%3A%2F%2Fguiwow.lanzoux.com%2FivbCSwzfhhg&t=%E6%96%87%E4%BB%B6&umuuid=1895dac4ac018-03cef0c6045837-7868796f-e1000-1895dac4ac4a8&rnd=867776463&f=57128346
                              msedge.exe
                              Remote address:
                              47.99.141.172:443
                              Request
                              GET /st/stat.htm?id=82&r=&lg=en-us&ntime=none&czst_eid=1242102598-3821-&showp=1280x720&p=https%3A%2F%2Fguiwow.lanzoux.com%2FivbCSwzfhhg&t=%E6%96%87%E4%BB%B6&umuuid=1895dac4ac018-03cef0c6045837-7868796f-e1000-1895dac4ac4a8&rnd=867776463&f=57128346 HTTP/2.0
                              host: hm.woozooo.com
                              sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
                              dnt: 1
                              sec-ch-ua-mobile: ?0
                              user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                              accept: */*
                              sec-fetch-site: cross-site
                              sec-fetch-mode: no-cors
                              sec-fetch-dest: script
                              referer: https://guiwow.lanzoux.com/
                              accept-encoding: gzip, deflate, br
                              accept-language: en-US,en;q=0.9
                              Response
                              HTTP/2.0 200
                              server: nginx/1.14.1
                              date: Sun, 16 Jul 2023 07:48:43 GMT
                              content-length: 0
                              vary: Origin
                              vary: Access-Control-Request-Method
                              vary: Access-Control-Request-Headers
                            • flag-us
                              DNS
                              191.46.235.103.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              191.46.235.103.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              172.141.99.47.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              172.141.99.47.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              208.194.73.20.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              208.194.73.20.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              103.169.127.40.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              103.169.127.40.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              171.39.242.20.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              171.39.242.20.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              9.57.101.20.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              9.57.101.20.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              1.208.79.178.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              1.208.79.178.in-addr.arpa
                              IN PTR
                              Response
                              1.208.79.178.in-addr.arpa
                              IN PTR
                              https-178-79-208-1amsllnwnet
                            • flag-us
                              DNS
                              edge.microsoft.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              edge.microsoft.com
                              IN A
                              Response
                              edge.microsoft.com
                              IN CNAME
                              edge-microsoft-com.dual-a-0036.a-msedge.net
                              edge-microsoft-com.dual-a-0036.a-msedge.net
                              IN CNAME
                              dual-a-0036.a-msedge.net
                              dual-a-0036.a-msedge.net
                              IN A
                              204.79.197.239
                              dual-a-0036.a-msedge.net
                              IN A
                              13.107.21.239
                            • flag-us
                              DNS
                              api.cognitive.microsofttranslator.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              api.cognitive.microsofttranslator.com
                              IN A
                              Response
                              api.cognitive.microsofttranslator.com
                              IN CNAME
                              dev-c.microsofttranslator.search.prod.ms.akadns.net
                              dev-c.microsofttranslator.search.prod.ms.akadns.net
                              IN A
                              20.50.1.16
                            • flag-us
                              DNS
                              239.197.79.204.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              239.197.79.204.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              16.1.50.20.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              16.1.50.20.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              guiwow.lanzoux.com
                              msedge.exe
                              Remote address:
                              8.8.8.8:53
                              Request
                              guiwow.lanzoux.com
                              IN A
                              Response
                              guiwow.lanzoux.com
                              IN CNAME
                              088af02c.lanzoux.com.cdn.dnsv1.com.cn
                              088af02c.lanzoux.com.cdn.dnsv1.com.cn
                              IN CNAME
                              cpb9pmt7.slt.sched.tdnsv8.com
                              cpb9pmt7.slt.sched.tdnsv8.com
                              IN A
                              116.153.64.158
                              cpb9pmt7.slt.sched.tdnsv8.com
                              IN A
                              116.172.148.7
                              cpb9pmt7.slt.sched.tdnsv8.com
                              IN A
                              119.188.86.194
                              cpb9pmt7.slt.sched.tdnsv8.com
                              IN A
                              116.163.24.195
                              cpb9pmt7.slt.sched.tdnsv8.com
                              IN A
                              42.236.89.185
                            • flag-us
                              DNS
                              126.22.238.8.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              126.22.238.8.in-addr.arpa
                              IN PTR
                              Response
                            • flag-us
                              DNS
                              89.16.208.104.in-addr.arpa
                              Remote address:
                              8.8.8.8:53
                              Request
                              89.16.208.104.in-addr.arpa
                              IN PTR
                              Response
                            • 2.22.54.187:443
                              assets.msn.com
                              tls
                              2.9kB
                               19.4kB
                               27
                              25
                            • 116.153.64.158:443
                              guiwow.lanzoux.com
                              tls
                              msedge.exe
                              1.2kB
                               5.2kB
                               13
                              14
                            • 116.153.64.158:443
                              guiwow.lanzoux.com
                              tls
                              msedge.exe
                              13.9kB
                               16.9kB
                               56
                              81
                            • 116.153.64.158:443
                              guiwow.lanzoux.com
                              tls
                              msedge.exe
                              1.1kB
                               4.9kB
                               11
                              12
                            • 219.151.25.35:443
                              https://assets.woozooo.com/assets/favicon.ico
                              tls, http2
                              msedge.exe
                              4.4kB
                               56.5kB
                               60
                              65

                              HTTP Request

                              GET https://assets.woozooo.com/assets/includes/js/jquery.js

                              HTTP Request

                              GET https://assets.woozooo.com/assets/img/qrcode.min.js

                              HTTP Response

                              200

                              HTTP Response

                              200

                              HTTP Request

                              GET https://assets.woozooo.com/assets/images/type/jar_max.gif

                              HTTP Response

                              200

                              HTTP Request

                              GET https://assets.woozooo.com/assets/favicon.ico

                              HTTP Response

                              200
                            • 219.151.25.35:443
                              assets.woozooo.com
                              tls, http2
                              msedge.exe
                              1.8kB
                               10.7kB
                               25
                              23
                            • 219.151.25.35:443
                              assets.woozooo.com
                              tls, http2
                              msedge.exe
                              1.8kB
                               10.7kB
                               25
                              23
                            • 60.188.66.35:443
                              https://statics.woozooo.com/img/hm.js
                              tls, http2
                              msedge.exe
                              2.3kB
                               12.9kB
                               25
                              28

                              HTTP Request

                              GET https://statics.woozooo.com/img/bd.js

                              HTTP Request

                              GET https://statics.woozooo.com/img/hm.js

                              HTTP Response

                              200

                              HTTP Response

                              200
                            • 60.188.66.35:443
                              statics.woozooo.com
                              tls
                              msedge.exe
                              1.5kB
                               10.5kB
                               18
                              20
                            • 60.188.66.35:443
                              statics.woozooo.com
                              tls, http2
                              msedge.exe
                              1.5kB
                               10.8kB
                               19
                              24
                            • 47.99.141.172:443
                              https://hm.woozooo.com/st/stat.htm?id=82&r=&lg=en-us&ntime=none&czst_eid=1242102598-3821-&showp=1280x720&p=https%3A%2F%2Fguiwow.lanzoux.com%2FivbCSwzfhhg&t=%E6%96%87%E4%BB%B6&umuuid=1895dac4ac018-03cef0c6045837-7868796f-e1000-1895dac4ac4a8&rnd=867776463&f=57128346
                              tls, http2
                              msedge.exe
                              2.1kB
                               10.9kB
                               18
                              20

                              HTTP Request

                              GET https://hm.woozooo.com/hm.js?v=1.2

                              HTTP Response

                              200

                              HTTP Request

                              GET https://hm.woozooo.com/st/stat.htm?id=82&r=&lg=en-us&ntime=none&czst_eid=1242102598-3821-&showp=1280x720&p=https%3A%2F%2Fguiwow.lanzoux.com%2FivbCSwzfhhg&t=%E6%96%87%E4%BB%B6&umuuid=1895dac4ac018-03cef0c6045837-7868796f-e1000-1895dac4ac4a8&rnd=867776463&f=57128346

                              HTTP Response

                              200
                            • 47.99.141.172:443
                              hm.woozooo.com
                              tls, http2
                              msedge.exe
                              1.7kB
                               5.3kB
                               13
                              12
                            • 103.235.46.191:443
                              hm.baidu.com
                              tls
                              msedge.exe
                              3.0kB
                               22.8kB
                               21
                              26
                            • 103.235.46.191:443
                              hm.baidu.com
                              tls
                              msedge.exe
                              1.6kB
                               10.0kB
                               21
                              17
                            • 204.79.197.239:443
                              edge.microsoft.com
                              tls
                              msedge.exe
                              2.2kB
                               8.6kB
                               14
                              18
                            • 20.50.1.16:443
                              api.cognitive.microsofttranslator.com
                              tls
                              msedge.exe
                              3.4kB
                               9.0kB
                               15
                              16
                            • 116.153.64.158:443
                              guiwow.lanzoux.com
                              tls
                              msedge.exe
                              1.1kB
                               4.9kB
                               11
                              12
                            • 116.153.64.158:443
                              guiwow.lanzoux.com
                              tls
                              msedge.exe
                              1.1kB
                               4.8kB
                               10
                              11
                            • 116.153.64.158:443
                              guiwow.lanzoux.com
                              tls
                              msedge.exe
                              1.1kB
                               4.9kB
                               11
                              12
                            • 8.8.8.8:53
                              8.8.8.8.in-addr.arpa
                              dns
                              66 B
                               90 B
                               1
                              1

                              DNS Request

                              8.8.8.8.in-addr.arpa

                            • 8.8.8.8:53
                              assets.msn.com
                              dns
                              60 B
                               166 B
                               1
                              1

                              DNS Request

                              assets.msn.com

                              DNS Response

                              2.22.54.187
                              2.22.54.144

                            • 8.8.8.8:53
                              187.54.22.2.in-addr.arpa
                              dns
                              70 B
                               133 B
                               1
                              1

                              DNS Request

                              187.54.22.2.in-addr.arpa

                            • 8.8.8.8:53
                              guiwow.lanzoux.com
                              dns
                              msedge.exe
                              64 B
                               235 B
                               1
                              1

                              DNS Request

                              guiwow.lanzoux.com

                              DNS Response

                              116.153.64.158
                              119.188.86.194
                              116.172.148.7
                              42.236.89.185
                              116.163.24.195

                            • 8.8.8.8:53
                              95.221.229.192.in-addr.arpa
                              dns
                              73 B
                               144 B
                               1
                              1

                              DNS Request

                              95.221.229.192.in-addr.arpa

                            • 8.8.8.8:53
                              57.169.31.20.in-addr.arpa
                              dns
                              71 B
                               157 B
                               1
                              1

                              DNS Request

                              57.169.31.20.in-addr.arpa

                            • 8.8.8.8:53
                              17.160.190.20.in-addr.arpa
                              dns
                              72 B
                               158 B
                               1
                              1

                              DNS Request

                              17.160.190.20.in-addr.arpa

                            • 8.8.8.8:53
                              assets.woozooo.com
                              dns
                              msedge.exe
                              64 B
                               299 B
                               1
                              1

                              DNS Request

                              assets.woozooo.com

                              DNS Response

                              219.151.25.35
                              182.106.158.35
                              182.107.80.35
                              182.140.225.35
                              183.60.219.35
                              182.84.110.35
                              220.169.152.35
                              125.64.104.35
                              106.117.216.35
                              111.174.1.35

                            • 8.8.8.8:53
                              158.64.153.116.in-addr.arpa
                              dns
                              73 B
                               132 B
                               1
                              1

                              DNS Request

                              158.64.153.116.in-addr.arpa

                            • 8.8.8.8:53
                              35.25.151.219.in-addr.arpa
                              dns
                              72 B
                               160 B
                               1
                              1

                              DNS Request

                              35.25.151.219.in-addr.arpa

                            • 224.0.0.251:5353
                              msedge.exe
                              592 B
                               9
                            • 8.8.8.8:53
                              158.240.127.40.in-addr.arpa
                              dns
                              73 B
                               147 B
                               1
                              1

                              DNS Request

                              158.240.127.40.in-addr.arpa

                            • 8.8.8.8:53
                              statics.woozooo.com
                              dns
                              msedge.exe
                              130 B
                               602 B
                               2
                              2

                              DNS Request

                              statics.woozooo.com

                              DNS Request

                              statics.woozooo.com

                              DNS Response

                              60.188.66.35
                              58.42.14.35
                              125.64.104.35
                              111.174.9.35
                              114.232.92.35
                              117.68.52.35
                              118.180.40.35
                              119.96.52.35
                              125.74.1.35
                              125.74.110.35

                              DNS Response

                              175.6.53.35
                              111.177.8.35
                              113.105.172.35
                              123.244.94.35
                              124.238.241.35
                              171.107.86.35
                              113.219.142.35
                              180.97.64.35
                              180.97.66.35
                              180.97.198.35

                            • 8.8.8.8:53
                              hm.baidu.com
                              dns
                              msedge.exe
                              116 B
                               200 B
                               2
                              2

                              DNS Request

                              hm.baidu.com

                              DNS Request

                              hm.baidu.com

                              DNS Response

                              103.235.46.191

                              DNS Response

                              103.235.46.191

                            • 8.8.8.8:53
                              hm.woozooo.com
                              dns
                              msedge.exe
                              120 B
                               152 B
                               2
                              2

                              DNS Request

                              hm.woozooo.com

                              DNS Request

                              hm.woozooo.com

                              DNS Response

                              47.99.141.172

                              DNS Response

                              47.99.141.172

                            • 8.8.8.8:53
                              35.66.188.60.in-addr.arpa
                              dns
                              71 B
                               128 B
                               1
                              1

                              DNS Request

                              35.66.188.60.in-addr.arpa

                            • 8.8.8.8:53
                              191.46.235.103.in-addr.arpa
                              dns
                              73 B
                               161 B
                               1
                              1

                              DNS Request

                              191.46.235.103.in-addr.arpa

                            • 8.8.8.8:53
                              172.141.99.47.in-addr.arpa
                              dns
                              72 B
                               143 B
                               1
                              1

                              DNS Request

                              172.141.99.47.in-addr.arpa

                            • 8.8.8.8:53
                              208.194.73.20.in-addr.arpa
                              dns
                              72 B
                               158 B
                               1
                              1

                              DNS Request

                              208.194.73.20.in-addr.arpa

                            • 8.8.8.8:53
                              103.169.127.40.in-addr.arpa
                              dns
                              73 B
                               147 B
                               1
                              1

                              DNS Request

                              103.169.127.40.in-addr.arpa

                            • 8.8.8.8:53
                              171.39.242.20.in-addr.arpa
                              dns
                              72 B
                               158 B
                               1
                              1

                              DNS Request

                              171.39.242.20.in-addr.arpa

                            • 8.8.8.8:53
                              9.57.101.20.in-addr.arpa
                              dns
                              70 B
                               156 B
                               1
                              1

                              DNS Request

                              9.57.101.20.in-addr.arpa

                            • 8.8.8.8:53
                              1.208.79.178.in-addr.arpa
                              dns
                              71 B
                               116 B
                               1
                              1

                              DNS Request

                              1.208.79.178.in-addr.arpa

                            • 8.8.8.8:53
                              edge.microsoft.com
                              dns
                              msedge.exe
                              64 B
                               167 B
                               1
                              1

                              DNS Request

                              edge.microsoft.com

                              DNS Response

                              204.79.197.239
                              13.107.21.239

                            • 8.8.8.8:53
                              api.cognitive.microsofttranslator.com
                              dns
                              msedge.exe
                              83 B
                               164 B
                               1
                              1

                              DNS Request

                              api.cognitive.microsofttranslator.com

                              DNS Response

                              20.50.1.16

                            • 8.8.8.8:53
                              239.197.79.204.in-addr.arpa
                              dns
                              73 B
                               143 B
                               1
                              1

                              DNS Request

                              239.197.79.204.in-addr.arpa

                            • 8.8.8.8:53
                              16.1.50.20.in-addr.arpa
                              dns
                              69 B
                               155 B
                               1
                              1

                              DNS Request

                              16.1.50.20.in-addr.arpa

                            • 8.8.8.8:53
                              guiwow.lanzoux.com
                              dns
                              msedge.exe
                              64 B
                               235 B
                               1
                              1

                              DNS Request

                              guiwow.lanzoux.com

                              DNS Response

                              116.153.64.158
                              116.172.148.7
                              119.188.86.194
                              116.163.24.195
                              42.236.89.185

                            • 8.8.8.8:53
                              126.22.238.8.in-addr.arpa
                              dns
                              71 B
                               125 B
                               1
                              1

                              DNS Request

                              126.22.238.8.in-addr.arpa

                            • 8.8.8.8:53
                              89.16.208.104.in-addr.arpa
                              dns
                              72 B
                               146 B
                               1
                              1

                              DNS Request

                              89.16.208.104.in-addr.arpa

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              8411007bafe7b1182af1ad3a1809b4f8

                              SHA1

                              4a78ee0762aadd53accae8bb211b8b18dc602070

                              SHA256

                              1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

                              SHA512

                              909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                              Filesize

                              144B

                              MD5

                              6a3f14bc7e95a7e0a8d4be64d9ca33ca

                              SHA1

                              557db54c1d9a50fa47e9a31ffafde18d2e4a9a70

                              SHA256

                              fbf4e811c552e178d6034bad12760c69f984cf0fb41171e1826ef42e892a0ce8

                              SHA512

                              bc75b6c587b811701f6242a1630719089ed41687268d47ea5a47b5d46963116c30df2f7e29bb99308bfb299bc6501df43004f5b34972e149c59262b5e0d90331

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                              Filesize

                              111B

                              MD5

                              807419ca9a4734feaf8d8563a003b048

                              SHA1

                              a723c7d60a65886ffa068711f1e900ccc85922a6

                              SHA256

                              aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                              SHA512

                              f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                              Filesize

                              506B

                              MD5

                              e9d43a33a994e803e5dbf7bec10a873e

                              SHA1

                              8093a0512a4bca2d18619876e15d9393a66bb3af

                              SHA256

                              33261424110b71e9bce6186a9b29c6c23c24c9e06eedbf09238ba59c1c5fd014

                              SHA512

                              13b9074b2e99fcad36cd90072a6cc494c0741c5b6232a1e489fb7fcdc470d38421adbc28af2c17105a768ee2230e015b65da40b5aeb0e92cd9f9ba5a170f44ce

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              5KB

                              MD5

                              81ab1a50f4101fb447d17b0d7e017763

                              SHA1

                              15a6ce6f2e1eafb590899edb92ac15977739408e

                              SHA256

                              e7fad1fa83b5b9985984ff28eec311fc79fcc2a2fe790abdcc782832fba0bc63

                              SHA512

                              87f29ad55703f80e2e2b8b7d118e5ca8cfdf41bda2ca39d3fe45489db0cfd9eeef116e747645dd4fdb12bfa3970eb9cc55f376278b738d668d9f6d14b3a206a9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              5KB

                              MD5

                              ecbd472d8a2599d2888106702b33bd70

                              SHA1

                              a10df0a4cdc1b296661bce98ae710d140da1f04b

                              SHA256

                              c261cb4af93c55a5ff55ffa4e520f1cd09d172dfa8b99b3e9af0a132b4febb54

                              SHA512

                              5464cb2aece5986d8e9951ba63e38197398df3301dc94c865129d1c4d7ddb849c71447a612b39a9bb8a699b7fa54dfa8e68ebb6e1413813d836d137c814b9c63

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              5KB

                              MD5

                              2ab935215303283579455c680d5a8aa9

                              SHA1

                              6152b8264c08b53465f565ab8124daad4a7d2de6

                              SHA256

                              fdab86cde6300c990afeb6513dc25f68501139d546adafea6961e2632365899b

                              SHA512

                              b003712cfba9fa59aa2c06693f2bacf1ebbd5594d17ee6647247533032e29a8a109c64f78536db9af6850f550d9f7f1ed8ca801435bf9c71f73d9f42d95d41d3

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              5KB

                              MD5

                              cfc60af01c93a06ca1c17db4902ee7f2

                              SHA1

                              016efcb0b8b1d9519a3dc45da6672c3807bd9201

                              SHA256

                              1cde3e3c8039b2c126e0b2253f60de9409e858f8302564f59a092477a8783356

                              SHA512

                              cbf76f14b1ba2fbc813e5f9741496cdc93406e0be44a9ef1b089b2f91b644aeceb3cfd620977e8d38ebc3a8e6b7952893386d2eea43d98aa688799c0b071ec59

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              ce16392e6b12353f508271488f4421ff

                              SHA1

                              a781a407fcea484937f68b0c972739c0b3f006b0

                              SHA256

                              ca72f54c0a7f942251630443d0233e6ec0192d39fb475c5db704a3bdd94c7d6d

                              SHA512

                              7f4e10744024e691a722ac40e90d8e8985f911931ef01a688f89978b40e8114f816a2ba7b5e317d1a7d89e11c938e1ef596ac2b5459e83a9659456f5db83cebc

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                              Filesize

                              24KB

                              MD5

                              8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

                              SHA1

                              83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

                              SHA256

                              0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

                              SHA512

                              084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                              Filesize

                              371B

                              MD5

                              32bc9c23a96014ad7a9542ff4174be6e

                              SHA1

                              f15b09d7e53ca5d103dae8d655ad30eedb854be5

                              SHA256

                              8f791f4944023c78cae16dd138e4377cec813e1e19178935befdad6d9e275fe4

                              SHA512

                              daff7e7ff48e583698d07fd076533fbb8788c664cd1f16a9b7d9124b15e11e6c5ccaae8097a07895c538460bb9b058d7a5de7882208581311b9541649ea54adf

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594184.TMP
                              Filesize

                              204B

                              MD5

                              bc895358a297e06067502e830e1410f9

                              SHA1

                              6fb98b1ac72a96d0d91854f03fffb463fdc6b9a0

                              SHA256

                              90ff99dad078abe66e166d63d026f2c57251407974283ebc8ec10fb77f4c3480

                              SHA512

                              5061c12183a5d321d0d47725e65a561d25e5496831bf4c337371076fa7e9716815ad520f1703e3c1819be399d3a08ca219a909f23e1e4609093103f3e2412e80

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              12KB

                              MD5

                              652104ebd993ae6aa6bf4de9f0483d64

                              SHA1

                              04c974628824af7340476a552357282fdfae8821

                              SHA256

                              45c87910ea3d083f66d7db2f32b879a89087f5d57592206b16c47c225b5cb689

                              SHA512

                              12eb0ca10c7fe828052a97114f690c8fb063da34330742e37bf6d7d228d1d47b46e61e935c6acb547f73895feaf12b788cbb22c0a4007bcfd859a17123724678

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              12KB

                              MD5

                              28cdc97704accdf2b70746ca3422d203

                              SHA1

                              7ff642941404d919065b1ece68f6845c556a26e1

                              SHA256

                              cd247086117818cf5e5d5acb3723f511c810025088e7923f7eabd79696dbe37e

                              SHA512

                              a53724666fd7a14de88cdeb2dec23cbb51e2435b9c65e063dab8659eae3543ec4ef6f7eb44ad581ef76d01be99dc045eb9a4692ef8be5339df123fd215ec0103

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              12KB

                              MD5

                              a0a9a46033326d041a332b9de09516a6

                              SHA1

                              f85a6151171d952c4916301efcb1a278731e2e32

                              SHA256

                              5c6c03e832a36904cf6643c1247fedf70c6e0da794c03482e57bf0cf8d0ed532

                              SHA512

                              c9d6fcd54af317ff2da978e95ec84d048523b97e77174b850505bb691146a2a1d27cc57063e0c02b059b8b425c6db1de73489b8c84c74788b0c5980ae1148fb2

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                              Filesize

                              2B

                              MD5

                              f3b25701fe362ec84616a93a45ce9998

                              SHA1

                              d62636d8caec13f04e28442a0a6fa1afeb024bbb

                              SHA256

                              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                              SHA512

                              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                              Download Submit

                            • memory/4812-189-0x00000255B2890000-0x00000255B2891000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4812-188-0x00000255B2890000-0x00000255B2891000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4812-187-0x00000255B2890000-0x00000255B2891000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4812-186-0x00000255B2890000-0x00000255B2891000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4812-185-0x00000255B2890000-0x00000255B2891000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4812-184-0x00000255B2890000-0x00000255B2891000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4812-183-0x00000255B2890000-0x00000255B2891000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4812-168-0x00000255B2890000-0x00000255B2891000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4812-169-0x00000255B2890000-0x00000255B2891000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4812-170-0x00000255B2890000-0x00000255B2891000-memory.dmp

                              Filesize

                              4KB

                              Download

                            We care about your privacy.

                            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.