Analysis Overview
Threat Level: Known bad
The file http://moviesjoy.is was found to be: Known bad.
Malicious Activity Summary
Browser Information Discovery
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-24 21:51
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-24 21:51
Reported
2024-12-24 21:53
Platform
win10v2004-20241007-en
Max time kernel
95s
Max time network
147s
Command Line
Signatures
Browser Information Discovery
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://moviesjoy.is
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1d5946f8,0x7ffc1d594708,0x7ffc1d594718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,246921508580339349,14114393578272969301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | moviesjoy.is | udp |
| US | 104.31.16.1:80 | moviesjoy.is | tcp |
| US | 104.31.16.1:80 | moviesjoy.is | tcp |
| US | 8.8.8.8:53 | www.cloudflare.com | udp |
| US | 104.31.16.1:443 | moviesjoy.is | tcp |
| US | 8.8.8.8:53 | moviesjoytv.to | udp |
| US | 172.67.136.137:443 | moviesjoytv.to | tcp |
| US | 8.8.8.8:53 | a.nel.cloudflare.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.16.31.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | 137.136.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.80.190.35.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | use.fontawesome.com | udp |
| US | 8.8.8.8:53 | stackpath.bootstrapcdn.com | udp |
| US | 8.8.8.8:53 | cdnjs.cloudflare.com | udp |
| US | 172.67.142.245:443 | use.fontawesome.com | tcp |
| US | 104.17.24.14:443 | cdnjs.cloudflare.com | tcp |
| US | 104.18.10.207:443 | stackpath.bootstrapcdn.com | tcp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| FR | 142.250.75.234:443 | ajax.googleapis.com | tcp |
| US | 8.8.8.8:53 | maxcdn.bootstrapcdn.com | udp |
| US | 8.8.8.8:53 | 14.24.17.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 207.10.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 245.142.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 170.201.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | platform-api.sharethis.com | udp |
| US | 8.8.8.8:53 | sz.createsgummous.com | udp |
| NL | 18.239.94.125:443 | platform-api.sharethis.com | tcp |
| NL | 23.109.170.127:443 | sz.createsgummous.com | tcp |
| US | 172.67.142.245:443 | use.fontawesome.com | tcp |
| US | 8.8.8.8:53 | 9animetv.to | udp |
| US | 8.8.8.8:53 | sysmeasuring.net | udp |
| US | 172.67.196.86:443 | sysmeasuring.net | tcp |
| US | 8.8.8.8:53 | bfyqjbelknb.com | udp |
| NL | 139.45.197.101:443 | bfyqjbelknb.com | tcp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 216.239.32.36:443 | region1.google-analytics.com | tcp |
| US | 8.8.8.8:53 | buttons-config.sharethis.com | udp |
| US | 8.8.8.8:53 | l.sharethis.com | udp |
| IE | 54.155.153.214:443 | l.sharethis.com | tcp |
| IE | 54.155.153.214:443 | l.sharethis.com | tcp |
| NL | 18.239.94.15:443 | buttons-config.sharethis.com | tcp |
| US | 8.8.8.8:53 | goboksehee.net | udp |
| NL | 139.45.197.107:443 | goboksehee.net | tcp |
| US | 8.8.8.8:53 | count-server.sharethis.com | udp |
| US | 8.8.8.8:53 | platform-cdn.sharethis.com | udp |
| US | 8.8.8.8:53 | my.rtmark.net | udp |
| NL | 18.239.36.71:443 | count-server.sharethis.com | tcp |
| NL | 18.238.243.102:443 | platform-cdn.sharethis.com | tcp |
| NL | 18.238.243.102:443 | platform-cdn.sharethis.com | tcp |
| NL | 18.238.243.102:443 | platform-cdn.sharethis.com | tcp |
| NL | 18.238.243.102:443 | platform-cdn.sharethis.com | tcp |
| NL | 18.238.243.102:443 | platform-cdn.sharethis.com | tcp |
| NL | 18.238.243.102:443 | platform-cdn.sharethis.com | tcp |
| US | 172.67.169.157:443 | my.rtmark.net | tcp |
| US | 8.8.8.8:53 | crt.rootg2.amazontrust.com | udp |
| NL | 18.239.83.27:80 | crt.rootg2.amazontrust.com | tcp |
| NL | 139.45.197.107:443 | goboksehee.net | tcp |
| US | 8.8.8.8:53 | 234.75.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 163.20.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.201.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 125.94.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 127.170.109.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.39.65.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.197.45.139.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.196.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 36.32.239.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.94.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 214.153.155.54.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.197.45.139.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.36.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 102.243.238.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.169.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.83.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tzegilo.com | udp |
| US | 104.21.11.245:443 | tzegilo.com | tcp |
| US | 8.8.8.8:53 | flerap.com | udp |
| US | 8.8.8.8:53 | fleraprt.com | udp |
| NL | 139.45.195.252:443 | fleraprt.com | tcp |
| NL | 139.45.195.252:443 | fleraprt.com | tcp |
| US | 8.8.8.8:53 | datatechonert.com | udp |
| NL | 37.48.68.71:443 | datatechonert.com | tcp |
| US | 8.8.8.8:53 | s.click.aliexpress.com | udp |
| US | 8.8.8.8:53 | 245.11.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 252.195.45.139.in-addr.arpa | udp |
| GB | 23.214.144.96:443 | s.click.aliexpress.com | tcp |
| US | 8.8.8.8:53 | www.aliexpress.com | udp |
| US | 8.8.8.8:53 | ae01.alicdn.com | udp |
| US | 8.8.8.8:53 | assets.alicdn.com | udp |
| GB | 23.214.144.96:443 | assets.alicdn.com | tcp |
| US | 8.8.8.8:53 | time-ae.akamaized.net | udp |
| US | 8.8.8.8:53 | ae.mmstat.com | udp |
| GB | 104.115.32.51:443 | ae01.alicdn.com | tcp |
| US | 8.8.8.8:53 | bottom.campaign.aliexpress.com | udp |
| GB | 23.214.144.96:443 | assets.alicdn.com | tcp |
| GB | 23.214.144.96:443 | assets.alicdn.com | tcp |
| GB | 23.214.144.96:443 | assets.alicdn.com | tcp |
| GB | 23.214.144.96:443 | assets.alicdn.com | tcp |
| US | 8.8.8.8:53 | s.go-mpulse.net | udp |
| GB | 104.91.71.11:443 | time-ae.akamaized.net | tcp |
| US | 8.8.8.8:53 | acs.aliexpress.com | udp |
| GB | 104.115.32.190:443 | s.go-mpulse.net | tcp |
| GB | 163.181.154.243:443 | bottom.campaign.aliexpress.com | tcp |
| US | 8.8.8.8:53 | acs.aliexpress.ru | udp |
| US | 8.8.8.8:53 | c.go-mpulse.net | udp |
| GB | 92.123.28.198:443 | c.go-mpulse.net | tcp |
| SG | 47.246.110.43:443 | ae.mmstat.com | tcp |
| US | 8.8.8.8:53 | cm.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | dmtracking2.alibaba.com | udp |
| US | 8.8.8.8:53 | fcmatch.google.com | udp |
| US | 8.8.8.8:53 | fcmatch.youtube.com | udp |
| US | 8.8.8.8:53 | fourier.taobao.com | udp |
| US | 8.8.8.8:53 | gj.mmstat.com | udp |
| US | 8.8.8.8:53 | 51.32.115.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 96.144.214.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.71.91.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 190.32.115.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 243.154.181.163.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.20.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.68.48.37.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.28.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | hd.mmstat.com | udp |
| US | 8.8.8.8:53 | pcookie.aliexpress.com | udp |
| US | 8.8.8.8:53 | stats.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| DE | 47.246.146.97:443 | acs.aliexpress.com | tcp |
| US | 8.8.8.8:53 | 43.110.246.47.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.146.246.47.in-addr.arpa | udp |
| US | 8.8.8.8:53 | dmtracking2.alibaba.com | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | aeis.alicdn.com | udp |
| US | 8.8.8.8:53 | 182.129.81.91.in-addr.arpa | udp |
| US | 216.239.32.36:443 | region1.google-analytics.com | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | e443ee4336fcf13c698b8ab5f3c173d0 |
| SHA1 | 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a |
| SHA256 | 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b |
| SHA512 | cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd |
\??\pipe\LOCAL\crashpad_4012_AJRPNFHMXBWEAFZP
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 56a4f78e21616a6e19da57228569489b |
| SHA1 | 21bfabbfc294d5f2aa1da825c5590d760483bc76 |
| SHA256 | d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb |
| SHA512 | c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | a864141cdfbd0710ef63db8d8d284bbe |
| SHA1 | de5fd05b02572d709436a8ce2a1f5d71cb230de0 |
| SHA256 | b44a7b5f5cb07b4804ec9516f0f85d2d96456a45d18c463ae1d50f9672067bb2 |
| SHA512 | 697a44f7105366214c189e9dbce4db31af9ed39f0047fe7a49708216c6fdc74a326df6b52a69f5daf9309483a69078fa86fdbc2f7e0427559bc6b91fdbbafde8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 0d6a29ee51558f707210b3a221c1fee6 |
| SHA1 | bf18ae53efa5af19312a269c5cd316a02465faa4 |
| SHA256 | 3c99501e7bdc603a348022d81c73f50206ac98a88030396367394fabab26aef8 |
| SHA512 | 2bce3fe385264a0b3786f647fa68cb5ee812e6ce04e40508c6b79b800110e1da44fbc5eb921daab6a3e7b261f1d0ddb5aad24e7ac2693b40652a3ae4a21b131f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c90bdf1c2714d339b732f248e7e6e6b2 |
| SHA1 | 6b53eae1957ba03b15e579bbb5a942be8721c3b7 |
| SHA256 | 869595253d87b3c606a8c79e575a83bffeeac2f0c0246594905415fa0d6a2bbd |
| SHA512 | ec0e1268f2b5d98ec90f8019d386a53be852a038a98a4f4e023b4de0c694172ea913af618e2ec93aa9c3f97c5e9042eaa063258b0d9b10a12566b200abfd021e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | db7a7c2713c789c94090a0d71caa00cb |
| SHA1 | a10f5cdfd44d39ff734eeaec8a3bd9728965fe23 |
| SHA256 | 231eebd85d9bee8aa164699b671c8ae0671398ec7092e6c82f6d48a1115a6ce0 |
| SHA512 | 1124444b381d0b961b72ac5cc97f6330527fa23287d4230886d91c19bdd6453a7b67492b884f86c8db867439798e9b881a374d6b5f2cf68249efd95a0eb9c9c0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fdc9.TMP
| MD5 | 029c6aa7d98063e4d86db30f54b0b57a |
| SHA1 | d64cae8b52a17685ab983756f5a06bea1319f079 |
| SHA256 | 2a15ad88c3b8d41d0d45c4bec0f9630438299b4acbd3d123c835c4edca1e902c |
| SHA512 | 86b6cf57162c673fc449277e3242425395c775170a0a7ef553bb7578cee45e49e9c5a7dd55f157f1ce10015613460e32fed3d2041d51a4ab2f81dfd371d14d22 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | c6420a842b74345b2d6b52238b1d6835 |
| SHA1 | 230754130490cbe9a5d0ea6d8d4885f510120e87 |
| SHA256 | 428777048ef15a77715e967f6967f129dc3f7ae610dcb2c506e3a245d2ab779f |
| SHA512 | cf2dbe31ba250b13a402135a01c3add4f6bf0263e16372e4a3fe0d53fbf7a9d203d571728367b0ca028d3ede51f6ac3049c28f5707e77038f1ec33a4e8248979 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
| MD5 | 5af87dfd673ba2115e2fcf5cfdb727ab |
| SHA1 | d5b5bbf396dc291274584ef71f444f420b6056f1 |
| SHA256 | f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4 |
| SHA512 | de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | 1dbf2c20cf572101efc5568c6e0ab6e1 |
| SHA1 | b9712c5e3cf1e81909c60ec1256b04134c7c77df |
| SHA256 | 4194fd3a88eecb3ad1df28fa76f48a2753f6b478b261044f578a941dfc1e90d6 |
| SHA512 | 84f46e172ea2a0ee047fd746578b9a5cb06f652c4f3bb1557eaa46e1ff5db1f42abb69f53d12bb7ebc28cb11eaa617e351b612868cfad6b5fbe3a2a256c423cd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 174e4ff0fb8aaf75746aba1bab3c4cb8 |
| SHA1 | ef0fc2a32d38e56301efe36b6d32edaca92a4289 |
| SHA256 | 184246fa08d1c79c2e4f5c5bc149ce7719b2322445e4a5fee1b3552d4a24b734 |
| SHA512 | afcafe41cc93c5ad75b73a5137d906e616e761f9813ff430bd7074d20d42997d4159b0ce9636c1209e623e48868fac6facf62bc026aeeeb27fc3c48f1268fe4b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5829ca.TMP
| MD5 | e205cec5c48bee99a5f8427e57268f53 |
| SHA1 | b75e2d7fa48e08e5f646dee45d6b2b861e235e79 |
| SHA256 | 25b93b9c7db4983e6904cf83ec13faf7979e58da97c1d829f72572705ee9fad4 |
| SHA512 | b8a600da2870d195985a99ed4bd3ed7e168318a3437448e91c4a49dbd373014b3fa47eba8e9c5fc3b07a69a0b8457975a4da12b8bca40f010b5998a470e09836 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | d64657ae9ff53ca055bbc51142ff7a78 |
| SHA1 | eb06b0fd9093bd0ef0e62793206c4e32d88ad3d3 |
| SHA256 | 83d026144b3d4e5430639e456935e9ba82fbae2bb6aab869050539e879fefeec |
| SHA512 | 8af84152951fdb4ddc88b6184d49e2f6bf5fed14286fc383bef1aadbab34c4af098d4460956e16f3140101a034375997e0ae8d8f636998b424897b67b54595e0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 127b9fd3bafb2eb0cb4b950c6d0ac63e |
| SHA1 | d3ce22e39887629d8f75faca4cba4a5be745057e |
| SHA256 | 6b89ebc4fd9abd853309bdd707799f49d7f0275bc91cb9a7dba34c1b177438d6 |
| SHA512 | 9fb0d04caf948e58ba0a896d9984fa2271fa867c2c30ee509e1f83bb0558aa48b8861dc4143e158d48bcd1bc9990f37796824ed3b34c64494da913c86f549819 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 2cdb4b8ac6c7ab0d243874ec9cdec9d8 |
| SHA1 | 247947f8ccd6e034fc051609ae24bed4ce87f77a |
| SHA256 | 3189fe25dd8f72f8548cdd94c9effb66fc74047ff139614e945ba51da20204c5 |
| SHA512 | bb0dc2c75e1e7e4c9994cf95329173613f20a554e9ed1fb900614a18c5111d16041156edd79e27846714e366da6b6069454b8f18455f92014ebf2c9a4e04f2f3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 27cfce02e5612e01bf947f8f80b49737 |
| SHA1 | 6904807f971cc2ce8baf5ff7235beb92760400be |
| SHA256 | 76589a1ed06b206f419af9f27db4d6b2e4ad5966295d15b0f44c7a517cd98c6f |
| SHA512 | 906f2d02818d1bad2e9f884f263eb713404da06ba36f60a4a99bdb0ebc6c5560029af0d4eec368f9abde54152279da3bcd6e84bbff5707cf75fbd74b91a836b0 |