Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a23414-1260.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a23417-170c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000003
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000004
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bbeebc0875c96757_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\249175c773d975db_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fb621d50e7a3536c_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\01b0fe16e790fb36_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7aa74233d26ce0fa_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b8a5d49e6a411d96_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6fbe3d771b15e414_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\974a62d6a817b659_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6f5fe91d9b0eaa98_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fc02eb71651fa7ac_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\9e2d54b855544c82_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000005
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000006
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000007
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000008
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\2cc80dabc69f58b6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\2cc80dabc69f58b6_1
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\5a42fcd78488c8413cca0e5abc9e6298a6529381\e5148eee-b879-44fe-83f0-697c6aa98d95\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\5a42fcd78488c8413cca0e5abc9e6298a6529381\e5148eee-b879-44fe-83f0-697c6aa98d95\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\default\quotamanager
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\f06361f7b56c094e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\5a42fcd78488c8413cca0e5abc9e6298a6529381\e5148eee-b879-44fe-83f0-697c6aa98d95\18723bd078cc8054_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a0cbb8553b8930a6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000009
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000a
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\67e970412ae9ed50_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000b
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000c
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\641fdc22fa17256b_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000d
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000e
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00000f
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000010
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000011
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\0d136e631f7d3c00_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000012
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5629b460259328a4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000013
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000014
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\5b5b1e0542390eba_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\4c574cbd0febe7f0_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\34620ca9819b22a4_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000015
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\583595ea91673ba8_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000016
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\e750f93d424d59ad_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\efaead5b26b69062_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c8ba08a2fdfba4aa_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000017
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000018
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000019
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\469ca3542dc6127a_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b9a1970fd1a77530_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b2d753dc5b0796eb_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\41800edff76940a6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c5bed109e2777c3a_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\93e5b50daf1ce8d9_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001a
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b5e68067df2bee6d_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001b
- %TEMP%\d188cfd8-a746-4e56-a5c2-c65e4057f1a1.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\135a9e73b7a29232_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\191c26457b1d8ca1_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\bd5decb9966bc2aa_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\a1e9163f75742b4e_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c92af07e381239d3_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001c
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\7f8d43c1f36945a8_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001d
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\babca9d3f41e96e6_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001e
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\c13081146e8e74b3_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\ffb13fb0caa86a78_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_00001f
- %TEMP%\3bb306db-282a-4fa4-be8d-582316c4fc37.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000020
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\3bebff8755aea567_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000021
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000022
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\6acd2e812ecdc585_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\006ed2a4aff1c74e_0
- %TEMP%\dada5aa8-25bc-40ab-88cf-2088ae572b73.tmp
- %TEMP%\51c907cd-3fe0-4352-a1b2-c9567c3de190.tmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000023
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\f_000024
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\b97b935da38d91c4_0
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\code cache\js\fb621d50e7a3536c_0
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a23414-1260.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-69a23417-170c.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index to %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\the-real-index
- from %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\database\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\5a42fcd78488c8413cca0e5abc9e6298a6529381\e5148eee-b879-44fe-83f0-697c6aa98d95\index-dir\temp-index to %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\5a42fcd78488c8413cca0e5abc9e6298a6529381\e5148eee-b879-44fe-83f0-697c6aa98d95\index-dir\the-real-index
- from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Modifies the following files
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %TEMP%\.ses
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\favicons
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\scriptcache\index-dir\temp-index
- %LOCALAPPDATA%\microsoft\edge\user data\default\service worker\cachestorage\5a42fcd78488c8413cca0e5abc9e6298a6529381\e5148eee-b879-44fe-83f0-697c6aa98d95\index-dir\temp-index
Network activity
Connects to
- 'co####.edge.skype.com':443
- 'pb#####.foroactivo.com':80
- 'pb#####.foroactivo.com':443
- 'x1.#.lencr.org':80
- '21#.#29.88.53':80
- 'js.##dan.com':443
- 'aj##.#oogleapis.com':443
- 'il##web.com':443
- 'co#####.facebook.net':443
- 'ca###.##nsentframework.com':443
- 'go#####agmanager.com':443
- 'i.###vimg.com':443
- '2i##.net':443
- 'i.##b.co':443
- 'ac.###iencerun.com':443
- 'cu#.##rsors-4u.net':443
- '4.##.#logspot.com':443
- 'pa####objects.com':443
- 'cr#.####g2.amazontrust.com':80
- 'cd#.#aboola.com':443
- 'x.##2.us':80
- 's.###kcdn.com':443
- 'wi####s.booked.net':443
- 'fa###ook.com':443
- 'a###ytics.google.com':443
- 'st###.#.doubleclick.net':443
- 'go#####a###ytics.com':443
- 'co####t.topicit.net':443
- 'go##le.ru':443
- 'so###cloud.com':443
- 'd.####encerun.com':443
- 'im####.googleapis.com':443
- 'cm.#.##ubleclick.net':443
- 'ma###.adsrvr.org':443
- 'vi#######.wikia.nocookie.net':443
- 'im####.pubmatic.com':443
- 'co#######l-content.sirdata.io':443
- 'sy##.##artadserver.com':443
- 'dp#.#emdex.net':443
- 'se####.adnxs.com':443
- 'cm#.###lytics.yahoo.com':443
- 're######.frontend.weborama.fr':443
- 'st####.##oudflareinsights.com':443
- 'co########ching.mediarithmics.com':443
- 'cd#.##delivr.net':443
- 'pi###.##biconproject.com':443
- 'sy##.#rwdcntrl.net':443
- 'on###g-sys.com':443
- 'pr###d.a-mo.net':443
- 'rt#.###premium.services':443
- 'pr####.media.net':443
- 'bt##.##arethrough.com':443
- 'fa######.rubiconproject.com':443
- 'ps.##eota.net':443
- 'sc###t.4dex.io':443
- 'cr###ivecdn.com':443
- 'sy##.#dkernel.com':443
- 'u.##enx.net':443
- 'id.#-mx.com':443
- 'id###ync.com':443
- 'gu#.#riteo.com':443
- 'eu#.###iconproject.com':443
- 'ad#.##bmatic.com':443
- 'to###.##biconproject.com':443
- 'a.###rtb.com':443
- 'il######vents.taboola.com':443
- 'ut.##bmatic.com':443
- 'a.###.#loudflare.com':443
- 'sy##.#aboola.com':443
- 'rt#.##adsrvr.com':443
- 'us####ync.fwmrm.net':443
- 'un####secelebre.com':443
- 'cs.###anmedia.com':443
- 't.###.opera.com':443
- 'ss########obal.smartadserver.com':443
- 'sy##.1rx.io':443
- 'x.###switch.net':443
- 'te##.com':443
- 's.#####n-adsystem.com':443
- 'um.##mpli.fi':443
- 'ad##id.info':443
TCP
HTTP GET requests
- http://pb#####.foroactivo.com/
- http://x1.#.lencr.org/
Other
- 'co####.edge.skype.com':443
- 'pb#####.foroactivo.com':443
- 'js.##dan.com':443
- 'aj##.#oogleapis.com':443
- 'il##web.com':443
- 'co#####.facebook.net':443
- 'ac.##uncdn.com':443
- 'go#####agmanager.com':443
- 'i.###vimg.com':443
- '2i##.net':443
- 'i.##b.co':443
- 'ac.###iencerun.com':443
- 'cu#.##rsors-4u.net':443
- 'pa####objects.com':443
- 'cd#.#aboola.com':443
- '4.##.#logspot.com':443
- 'fa###ook.com':443
- 'st###.#.doubleclick.net':443
- 'a###ytics.google.com':443
- 'go#####a###ytics.com':443
- 'go##le.ru':443
- 'co####t.topicit.net':443
- 'so###cloud.com':443
- 'd.####encerun.com':443
- 'im####.googleapis.com':443
- 'cm.#.##ubleclick.net':443
- 'ma###.adsrvr.org':443
- 'im####.pubmatic.com':443
- 'sy##.##artadserver.com':443
- 'ap#.####entframework.com':443
- 'vi#######.wikia.nocookie.net':443
- 'dp#.#emdex.net':443
- 'ib.##nxs.com':443
- 'cm#.###lytics.yahoo.com':443
- 're######.frontend.weborama.fr':443
- 'st####.##oudflareinsights.com':443
- 'co########ching.mediarithmics.com':443
- 'cd#.##delivr.net':443
- 'pi######.rubiconproject.com':443
- 'sy##.#rwdcntrl.net':443
- 'pr####.media.net':443
- 'pr###d.a-mo.net':443
- 'on###g-sys.com':443
- 'bt##.##arethrough.com':443
- 'fa######.rubiconproject.com':443
- 'ps.##eota.net':443
- 'cr###ivecdn.com':443
- 'sy##.#dkernel.com':443
- 'u.##enx.net':443
- 'id.#-mx.com':443
- 'eu#.###iconproject.com':443
- 'dn##dn.net':443
- 'id###ync.com':443
- 'ad#.##bmatic.com':443
- 'a.###rtb.com':443
- 'il######vents.taboola.com':443
- 'ut.##bmatic.com':443
- 'a.###.#loudflare.com':443
- 'am#####h.taboola.com':443
- 'rt#.##adsrvr.com':443
- 'us####ync.fwmrm.net':443
- 'un####secelebre.com':443
- 't.###.opera.com':443
- 'ss########obal.smartadserver.com':443
- 'x.###switch.net':443
- 'sy##.1rx.io':443
- 'te##.com':443
- 'cs.###anmedia.com':443
- 's.#####n-adsystem.com':443
- 'um.##mpli.fi':443
UDP
- DNS ASK gr#####r.blogspot.pe
- DNS ASK co####.edge.skype.com
- DNS ASK pb#####.foroactivo.com
- DNS ASK x1.#.lencr.org
- DNS ASK ma#.#ddan.com
- DNS ASK js.##dan.com
- DNS ASK aj##.#oogleapis.com
- DNS ASK il##web.com
- DNS ASK co#####.facebook.net
- DNS ASK ca###.##nsentframework.com
- DNS ASK go#####agmanager.com
- DNS ASK ch#####.#onsentframework.com
- DNS ASK ac.###iencerun.com
- DNS ASK i.###vimg.com
- DNS ASK 2i##.net
- DNS ASK i.##b.co
- DNS ASK cu#.##rsors-4u.net
- DNS ASK 4.##.#logspot.com
- DNS ASK pa####objects.com
- DNS ASK cr#.####g2.amazontrust.com
- DNS ASK cd#.#aboola.com
- DNS ASK x.##2.us
- DNS ASK s.###kcdn.com
- DNS ASK wi####s.booked.net
- DNS ASK fa###ook.com
- DNS ASK a###ytics.google.com
- DNS ASK st###.#.doubleclick.net
- DNS ASK co####t.topicit.net
- DNS ASK go#####a###ytics.com
- DNS ASK go##le.ru
- DNS ASK so###cloud.com
- DNS ASK d.####encerun.com
- DNS ASK ac.##uncdn.com
- DNS ASK d.###oomy.com
- DNS ASK hb#####id.pubmatic.com
- DNS ASK ta######g.unrulymedia.com
- DNS ASK im####.googleapis.com
- DNS ASK vi#######.wikia.nocookie.net
- DNS ASK co#######l-content.sirdata.io
- DNS ASK cm.#.##ubleclick.net
- DNS ASK ma###.adsrvr.org
- DNS ASK im####.pubmatic.com
- DNS ASK sy##.##artadserver.com
- DNS ASK dp#.#emdex.net
- DNS ASK se####.adnxs.com
- DNS ASK cm#.###lytics.yahoo.com
- DNS ASK re######.frontend.weborama.fr
- DNS ASK st####.##oudflareinsights.com
- DNS ASK co########ching.mediarithmics.com
- DNS ASK cd#.##delivr.net
- DNS ASK pi###.##biconproject.com
- DNS ASK sy##.#rwdcntrl.net
- DNS ASK up#.###lytics.yahoo.com
- DNS ASK pr###d.a-mo.net
- DNS ASK pr########ver.rubiconproject.com
- DNS ASK on###g-sys.com
- DNS ASK pr####.media.net
- DNS ASK mp.#dex.io
- DNS ASK bt##.##arethrough.com
- DNS ASK rt#.###premium.services
- DNS ASK fa######.rubiconproject.com
- DNS ASK ps.##eota.net
- DNS ASK sc###t.4dex.io
- DNS ASK cr###ivecdn.com
- DNS ASK sy##.#dkernel.com
- DNS ASK u.##enx.net
- DNS ASK tr#.#aboola.com
- DNS ASK id.#-mx.com
- DNS ASK gu#.#riteo.com
- DNS ASK id###ync.com
- DNS ASK eu#.###iconproject.com
- DNS ASK ad#.##bmatic.com
- DNS ASK to###.##biconproject.com
- DNS ASK a.###rtb.com
- DNS ASK il######vents.taboola.com
- DNS ASK im####.taboola.com
- DNS ASK dn##dn.net
- DNS ASK ut.##bmatic.com
- DNS ASK vi####t.taboola.com
- DNS ASK a.###.#loudflare.com
- DNS ASK sy##.#aboola.com
- DNS ASK ib.##nxs.com
- DNS ASK un####secelebre.com
- DNS ASK rt#.##adsrvr.com
- DNS ASK pi######.rubiconproject.com
- DNS ASK us####ync.fwmrm.net
- DNS ASK t.###.opera.com
- DNS ASK cs.###anmedia.com
- DNS ASK ss########obal.smartadserver.com
- DNS ASK sy##.1rx.io
- DNS ASK x.###switch.net
- DNS ASK im#####p.taboola.com
- DNS ASK am#####h.taboola.com
- DNS ASK te##.com
- DNS ASK wf.##boola.com
- DNS ASK am######vents.taboola.com
- DNS ASK s.#####n-adsystem.com
- DNS ASK um.##mpli.fi
- DNS ASK vi#####b.taboola.com
- DNS ASK am###.taboola.com
- DNS ASK ad##id.info
- DNS ASK ap#.####entframework.com
Miscellaneous
Searches for the following windows
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Executes the following
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument http://pbkaybo.foroactivo.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://pbkaybo.foroactivo.com/
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1800,7032716717415514376,3314067580121937001,131072 --lang=en-US --service-sandbox-type=none --mojo-p...
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate http://pbkaybo.foroactivo.com/' (with hidden window)
