Analysis Overview
Threat Level: Likely benign
The file http://payeecentral.amazon.com/Invoices was found to be: Likely benign.
Malicious Activity Summary
Detected potential entity reuse from brand amazon.
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-29 13:33
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-29 13:33
Reported
2024-05-29 13:38
Platform
win10-20240404-en
Max time kernel
299s
Max time network
298s
Command Line
Signatures
Detected potential entity reuse from brand amazon.
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133614632263576360" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://payeecentral.amazon.com/Invoices
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe2d509758,0x7ffe2d509768,0x7ffe2d509778
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2040 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2600 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2608 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4440 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5096 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5348 --field-trial-handle=1744,i,3426163465548045506,14737093878247275566,131072 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | payeecentral.amazon.com | udp |
| US | 54.239.16.252:80 | payeecentral.amazon.com | tcp |
| US | 54.239.16.252:80 | payeecentral.amazon.com | tcp |
| US | 8.8.8.8:53 | www.amazon.com | udp |
| FR | 52.222.148.112:443 | www.amazon.com | tcp |
| US | 8.8.8.8:53 | images-na.ssl-images-amazon.com | udp |
| US | 8.8.8.8:53 | 252.16.239.54.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 112.148.222.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 18.245.198.40:443 | images-na.ssl-images-amazon.com | tcp |
| US | 18.245.198.40:443 | images-na.ssl-images-amazon.com | tcp |
| US | 18.245.198.40:443 | images-na.ssl-images-amazon.com | tcp |
| US | 8.8.8.8:53 | static.siege-amazon.com | udp |
| US | 8.8.8.8:53 | fls-na.amazon.com | udp |
| US | 18.245.198.40:443 | images-na.ssl-images-amazon.com | udp |
| US | 8.8.8.8:53 | m.media-amazon.com | udp |
| US | 50.16.103.28:443 | fls-na.amazon.com | tcp |
| FR | 3.162.38.64:443 | static.siege-amazon.com | tcp |
| US | 8.8.8.8:53 | content-autofill.googleapis.com | udp |
| US | 18.245.198.40:443 | m.media-amazon.com | tcp |
| GB | 216.58.212.202:443 | content-autofill.googleapis.com | tcp |
| FR | 52.222.148.112:443 | www.amazon.com | udp |
| US | 8.8.8.8:53 | unagi-na.amazon.com | udp |
| US | 52.46.136.110:443 | unagi-na.amazon.com | tcp |
| US | 8.8.8.8:53 | 40.198.245.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.38.162.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.103.16.50.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 51.201.222.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.136.46.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | unagi.amazon.com | udp |
| US | 67.220.247.74:443 | unagi.amazon.com | tcp |
| US | 8.8.8.8:53 | 74.247.220.67.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 18.245.198.40:443 | m.media-amazon.com | udp |
| GB | 216.58.212.202:443 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | completion.amazon.com | udp |
| US | 18.245.198.40:443 | m.media-amazon.com | udp |
| US | 18.245.198.40:443 | m.media-amazon.com | udp |
| US | 8.8.8.8:53 | advertising.amazon.com | udp |
| US | 8.8.8.8:53 | affiliate-program.amazon.com | udp |
| US | 8.8.8.8:53 | aws.amazon.com | udp |
| US | 8.8.8.8:53 | blinkforhome.com | udp |
| US | 8.8.8.8:53 | blog.aboutamazon.com | udp |
| US | 8.8.8.8:53 | developer.amazon.com | udp |
| US | 8.8.8.8:53 | www.zappos.com | udp |
| US | 8.8.8.8:53 | eero.com | udp |
| US | 8.8.8.8:53 | go.thehub-amazon.com | udp |
| US | 8.8.8.8:53 | kdp.amazon.com | udp |
| US | 8.8.8.8:53 | music.amazon.com | udp |
| US | 8.8.8.8:53 | pro.imdb.com | udp |
| US | 44.215.134.156:443 | completion.amazon.com | tcp |
| US | 8.8.8.8:53 | ring.com | udp |
| US | 8.8.8.8:53 | sell.amazon.com | udp |
| US | 8.8.8.8:53 | services.amazon.com | udp |
| US | 8.8.8.8:53 | shop.ring.com | udp |
| US | 8.8.8.8:53 | videodirect.amazon.com | udp |
| US | 8.8.8.8:53 | www.6pm.com | udp |
| US | 8.8.8.8:53 | www.abebooks.com | udp |
| US | 8.8.8.8:53 | www.aboutamazon.com | udp |
| US | 8.8.8.8:53 | www.acx.com | udp |
| US | 8.8.8.8:53 | www.amazon.jobs | udp |
| US | 8.8.8.8:53 | www.amazon.science | udp |
| US | 8.8.8.8:53 | www.audible.com | udp |
| US | 8.8.8.8:53 | www.boxofficemojo.com | udp |
| US | 8.8.8.8:53 | www.goodreads.com | udp |
| US | 8.8.8.8:53 | www.imdb.com | udp |
| US | 8.8.8.8:53 | www.pillpack.com | udp |
| US | 8.8.8.8:53 | www.shopbop.com | udp |
| US | 8.8.8.8:53 | c.amazon-adsystem.com | udp |
| US | 8.8.8.8:53 | www.woot.com | udp |
| GB | 13.224.223.9:443 | c.amazon-adsystem.com | tcp |
| US | 8.8.8.8:53 | 156.134.215.44.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.223.224.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | s.amazon-adsystem.com | udp |
| US | 52.46.128.147:443 | s.amazon-adsystem.com | tcp |
| US | 67.220.247.74:443 | unagi.amazon.com | tcp |
| US | 8.8.8.8:53 | ib.adnxs.com | udp |
| US | 8.8.8.8:53 | match.360yield.com | udp |
| FR | 52.222.167.201:443 | www.imdb.com | tcp |
| US | 8.8.8.8:53 | rtb-csync.smartadserver.com | udp |
| US | 8.8.8.8:53 | dsum-sec.casalemedia.com | udp |
| US | 8.8.8.8:53 | pbs.yahoo.com | udp |
| US | 8.8.8.8:53 | capi.connatix.com | udp |
| US | 8.8.8.8:53 | amazon.partners.tremorhub.com | udp |
| US | 8.8.8.8:53 | usersync.samplicio.us | udp |
| US | 8.8.8.8:53 | ads.samba.tv | udp |
| US | 8.8.8.8:53 | 147.128.46.52.in-addr.arpa | udp |
| NL | 185.89.210.212:443 | ib.adnxs.com | tcp |
| NL | 89.149.192.200:443 | rtb-csync.smartadserver.com | tcp |
| IE | 52.208.202.34:443 | match.360yield.com | tcp |
| US | 104.18.36.155:443 | dsum-sec.casalemedia.com | tcp |
| US | 172.64.146.152:443 | capi.connatix.com | tcp |
| DE | 52.29.57.157:443 | usersync.samplicio.us | tcp |
| GB | 87.248.114.12:443 | pbs.yahoo.com | tcp |
| US | 3.224.9.206:443 | amazon.partners.tremorhub.com | tcp |
| US | 52.205.105.67:443 | ads.samba.tv | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| US | 8.8.8.8:53 | pixel.rubiconproject.com | udp |
| US | 8.8.8.8:53 | dpm.demdex.net | udp |
| NL | 23.63.101.170:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | odr.mookie1.com | udp |
| US | 8.8.8.8:53 | c1.adform.net | udp |
| US | 8.8.8.8:53 | bs.serving-sys.com | udp |
| US | 52.46.128.147:443 | s.amazon-adsystem.com | tcp |
| NL | 69.173.156.149:443 | pixel.rubiconproject.com | tcp |
| IE | 54.171.245.222:443 | dpm.demdex.net | tcp |
| DE | 52.58.58.112:443 | bs.serving-sys.com | tcp |
| DK | 37.157.6.233:443 | c1.adform.net | tcp |
| US | 34.160.236.64:443 | odr.mookie1.com | tcp |
| US | 8.8.8.8:53 | cookie-matching.mediarithmics.com | udp |
| FR | 54.36.150.181:443 | cookie-matching.mediarithmics.com | tcp |
| US | 104.18.36.155:443 | dsum-sec.casalemedia.com | udp |
| US | 52.46.128.147:443 | s.amazon-adsystem.com | tcp |
| US | 52.46.128.147:443 | s.amazon-adsystem.com | tcp |
| US | 8.8.8.8:53 | csync.loopme.me | udp |
| US | 52.46.128.147:443 | s.amazon-adsystem.com | tcp |
| US | 8.8.8.8:53 | lm.serving-sys.com | udp |
| NL | 35.214.244.87:443 | csync.loopme.me | tcp |
| US | 52.46.128.147:443 | s.amazon-adsystem.com | tcp |
| US | 8.8.8.8:53 | ssum-sec.casalemedia.com | udp |
| DE | 52.28.91.150:443 | lm.serving-sys.com | tcp |
| US | 8.8.8.8:53 | crb.kargo.com | udp |
| US | 8.8.8.8:53 | image2.pubmatic.com | udp |
| GB | 185.64.191.210:443 | image2.pubmatic.com | tcp |
| DE | 52.58.57.61:443 | crb.kargo.com | tcp |
| US | 8.8.8.8:53 | token.rubiconproject.com | udp |
| US | 8.8.8.8:53 | loadus.exelator.com | udp |
| US | 8.8.8.8:53 | cm.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| NL | 69.173.156.149:443 | token.rubiconproject.com | tcp |
| US | 8.8.8.8:53 | lciapi.ninthdecimal.com | udp |
| US | 8.8.8.8:53 | sync-amazon.ads.yieldmo.com | udp |
| IE | 34.254.143.3:443 | loadus.exelator.com | tcp |
| GB | 172.217.169.66:443 | cm.g.doubleclick.net | tcp |
| GB | 163.70.151.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | us-u.openx.net | udp |
| US | 35.172.176.162:443 | lciapi.ninthdecimal.com | tcp |
| IE | 54.78.106.82:443 | sync-amazon.ads.yieldmo.com | tcp |
| US | 35.244.159.8:443 | us-u.openx.net | tcp |
| US | 8.8.8.8:53 | sync.taboola.com | udp |
| US | 8.8.8.8:53 | aa.agkn.com | udp |
| NL | 141.226.228.48:443 | sync.taboola.com | tcp |
| IE | 52.213.222.54:443 | aa.agkn.com | tcp |
| US | 8.8.8.8:53 | x.bidswitch.net | udp |
| GB | 172.217.169.66:443 | cm.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | tags.bluekai.com | udp |
| US | 8.8.8.8:53 | public-prod-dspcookiematching.dmxleo.com | udp |
| US | 8.8.8.8:53 | cms.analytics.yahoo.com | udp |
| BE | 23.55.96.210:443 | tags.bluekai.com | tcp |
| NL | 35.214.149.91:443 | x.bidswitch.net | tcp |
| FR | 188.65.124.66:443 | public-prod-dspcookiematching.dmxleo.com | tcp |
| US | 8.8.8.8:53 | ads.stickyadstv.com | udp |
| DE | 3.71.149.231:443 | cms.analytics.yahoo.com | tcp |
| US | 8.8.8.8:53 | 201.167.222.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.210.89.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.192.149.89.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.146.64.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.114.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 155.36.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.202.208.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.9.224.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.57.29.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.105.205.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 222.245.171.54.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.156.173.69.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.236.160.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 112.58.58.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 181.150.36.54.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.6.157.37.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 87.244.214.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.38.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 150.91.28.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 61.57.58.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.151.70.163.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.143.254.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.106.78.54.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.159.244.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 162.176.172.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 170.101.63.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.228.226.141.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.222.213.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | sync.rfp.fout.jp | udp |
| FR | 154.54.250.81:443 | ads.stickyadstv.com | tcp |
| US | 35.186.196.148:443 | sync.rfp.fout.jp | tcp |
| US | 8.8.8.8:53 | beacon.krxd.net | udp |
| NL | 35.214.149.91:443 | x.bidswitch.net | tcp |
| US | 8.8.8.8:53 | match.sharethrough.com | udp |
| FR | 154.54.250.81:443 | ads.stickyadstv.com | tcp |
| US | 8.8.8.8:53 | ups.analytics.yahoo.com | udp |
| DE | 3.78.160.255:443 | match.sharethrough.com | tcp |
| US | 8.8.8.8:53 | usermatch.krxd.net | udp |
| US | 35.244.159.8:443 | us-u.openx.net | udp |
| US | 8.8.8.8:53 | sb.scorecardresearch.com | udp |
| US | 8.8.8.8:53 | eb2.3lift.com | udp |
| FR | 18.155.129.121:443 | sb.scorecardresearch.com | tcp |
| US | 8.8.8.8:53 | uipglob.semasio.net | udp |
| US | 76.223.111.18:443 | eb2.3lift.com | tcp |
| DK | 77.243.51.121:443 | uipglob.semasio.net | tcp |
| US | 8.8.8.8:53 | usersync.gumgum.com | udp |
| US | 8.8.8.8:53 | pi.ispot.tv | udp |
| US | 8.8.8.8:53 | image6.pubmatic.com | udp |
| IE | 34.247.233.198:443 | usersync.gumgum.com | tcp |
| US | 151.101.2.132:443 | pi.ispot.tv | tcp |
| NL | 198.47.127.19:443 | image6.pubmatic.com | tcp |
| US | 8.8.8.8:53 | 210.96.55.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 91.149.214.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 231.149.71.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.250.54.154.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.124.65.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 148.196.186.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.129.155.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 255.160.78.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.111.223.76.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.51.243.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.233.247.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 132.2.101.151.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.127.47.198.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.21.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.amazon.com | udp |
| US | 8.8.8.8:53 | 88.16.208.104.in-addr.arpa | udp |
Files
\??\pipe\crashpad_3296_CWSKOPTVNSQDLNND
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
| MD5 | 99914b932bd37a50b983c5e7c90ae93b |
| SHA1 | bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f |
| SHA256 | 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a |
| SHA512 | 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 36775b7fc5bab0983a118a046542fa42 |
| SHA1 | e69088b4ab6a144d1952816df27c5ae2f657d4ac |
| SHA256 | a1af302a48309f205b369242f22f18cc4db8e557e686465b54944b1c884e1fe7 |
| SHA512 | 72ef3804013044f469c1e164db2312bd4019439446398c7fdadd9079231761b6b585d67037af981877592675ae7e131240d32dcbea77bf0967279172c13cd9d0 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 7c0c621981f8e3e718d8dfc5f4a9d7af |
| SHA1 | ee5b79726145a61e39f0ec23e962959fd2167ef0 |
| SHA256 | 2216dd4997cebc7e015c316a9a964562dadac1cad6a9d61a715f3f47da4e3c81 |
| SHA512 | de10a012ef51d055930c64fdacea7242154f3c6e82d496ccac9bfe1e4794bc97cc56b7e4713f3dc3da5094b3ecd4f591cff4cf914003991791d8f8eadd901060 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ecf23aa5392fc218c502d01131131f78 |
| SHA1 | cf5f7ef9ffb2d557323849685312b424f602b6f9 |
| SHA256 | 8239ccc242ce1dffe004f43b817e5dafe10da2cedb4817643b004b59882d67d8 |
| SHA512 | d32892a6cd84ea8606620258b54f0ffc7a79c8fb837dfeca543d8c6cd4e6827b0cda45d96bb4fa5fc7421a1ee9864d8cc701aec128798f6d9314475fd06ed6f6 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | afe6b58d45a818a860133e90c9ffd986 |
| SHA1 | e09f92bf3be433a245b7da2c0fbe6ea582637a7b |
| SHA256 | ef5fbd4d6bfae9ce8a5bc7ef27f97044f7e05c8cdbe27952a8283eaf21f47d8b |
| SHA512 | 01ce08319bd9134ace2bdf3c290eb3e40a14d254c27c9e7a020c6e0770e820d17d1db0d46ec58b056c1ba8a1edf5431e6d086e2bd655b59f5289f7f8df842163 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 2ee076399cc87b360b520e383a909c90 |
| SHA1 | b11c794fd16aea7816f177de3b244b06506b69be |
| SHA256 | cadfa9e5afdcef1a01c874acef218bdc7f6111aa42df96fe199f9e8341991d33 |
| SHA512 | c39ee9bd227ddda5d7716df47ebb1f29a2ee54c5ec944d7334c709d4d0ded6e92092954692d3edcc1f157529839f760aa533d618054e50229bc639f48a570f8a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 5b68eb21d46bbb333d6e7eb5a5b6dcff |
| SHA1 | 6649196ee5ee1e304ec60ceee61a4fb8fc9a6fed |
| SHA256 | 1229914ce0533513e1c8eaeb04834893946cd4cc31b5f85098df944240db8e9a |
| SHA512 | 055b72d493c2f91b3dc942640938e1c377a334b59a19ee8cb1043f6142d040dadb6321b50f0605f3b9c1b890c7059d9a0356630b44189898eaf817ab2a379fbb |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 7946bdfed8cb526b1a20652c71eb20c5 |
| SHA1 | 72f1eb2760af61e39507353a24ab055bf31d1a1f |
| SHA256 | 367996f557ab79d3388e341b1eb26390d7eb2eebf261061a1f22d2961cba46a3 |
| SHA512 | 93a3ff78a9da984cdb9124b9c627da2df3f4a8961839533998fd2b339e065333f8765f95756c2509c227eb30a259c9b7673db901cf99f56d5eca660b912b80c1 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
| MD5 | ac286f97df72ac909a4338cd9837ea6d |
| SHA1 | 154fa23551735e322fccfae02ee2002e43edbcb7 |
| SHA256 | ff64b2fcd5f48d34fadee76ecc2c81f90fe00c717ed0dfe1f314da34e6f0e235 |
| SHA512 | 42bbab00691a396a51b10ae735ef133f8e0bef18a274162f2773a456dbdb6be8df10499baabe8a5b73fe199d51dd2bfa470cf44cb2e797f0a21cda6cd599e25f |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5821eb.TMP
| MD5 | 04284ff586fad60d238dc752e64e6307 |
| SHA1 | f279e194fe38b9f3a7f6a5d78bc3f5be2eb914a3 |
| SHA256 | 095ac2b82591697686f2bfd10c9eab223c18a75a39ff910d14f2f78aeec22f63 |
| SHA512 | 5c96333df7fa7f4801c24d16548f8c7914342733839f90f28e185b40c431226d10d0b51c771687be2963dab79403f7aa54c07b7e9c1fdc317c5ea8b41fa53fec |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 1a1f023a5f6902147414f1e4be61a8c6 |
| SHA1 | 21a12e2ef5f2c82a1415021188b69e5a0f5c229e |
| SHA256 | c74314d1720c211936c2b456e6002afa97b6212ee98aa0d7b661703d7a2543f7 |
| SHA512 | b8413c9d9014117567a8ed940d13b5d348bc4ff1b618906b1778b31fa256aa68f49405836eca020c01f8c358161da6d5604296d511993625e788a7bf5154a27d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | 0c0491ee366af19a336c189a45240c30 |
| SHA1 | 483eeaa9bd7f79f88687abaad25a80524c4471fb |
| SHA256 | ec28a07d645055fc8790fbc667eb14202f0631c3732fb88a7db348a6cc9553e2 |
| SHA512 | bcdadae6ccee42d83bddf1a73606dbb703751c8dfffd84016f69ef5bb03348609d98aaa9a673fc5ac72f1d6f5424fcb129e24587af62dab7f26e80043eefc018 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584adf.TMP
| MD5 | cb5c38b81389f897d270c1435a8bfc87 |
| SHA1 | 2fb762ccf89cf4b7f77d4e3964c03acb456a6d2b |
| SHA256 | 981e4bd1588cb52851edd7d8790892940b4f211a7df804bf349811ae3e0ff668 |
| SHA512 | c3f34f1b63fcd55ee354f90fef56bbb39ad49e8ec303672c33fcae6354f52909bda7797ee13c5b08c8e30eb2796e1c1ac60578a33e7159936f336b1bfc85d732 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 2e9ec82f4351cb56968597978521667e |
| SHA1 | a3573a57f93cc26122b30e111cf12617e86c605f |
| SHA256 | 8bcc86a6df5b1f8c8e88320f1b1e64837e9830a0c108f0bdfcaa0bb4586a4a6e |
| SHA512 | ae319d084c652c7bcc5ce270a33b6939d49b20ee88c307cffabd365f45392fb662684249ff5b884d836ef59ae6acaf8f07186a65ac79c1a462cd37b94e2e2cc3 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 564218326cd1b83b79dcd6e246f16313 |
| SHA1 | 0f9a2435ab2c59863069adde819ee33bee068cf4 |
| SHA256 | 55f206a35c2d7e02177d343a83699dbfce22ad9dcd26f557d22d38ffe2de2921 |
| SHA512 | 859eb8222410339e0d032b13f5dd210a255334c0b045ccbf6df975c4eb46cd3f8e7969d7698ecee884b632d67814dbd5dca11318354caf580b73d93bd9073192 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | df92d746eeeb01814f1160e1da8fae80 |
| SHA1 | 97b0f1e541fdb4a5d3076645671e93b5e211b84f |
| SHA256 | e99da1b10c2bd548f1ed6c7cdacc9e0dd43d0856c2ba005cf2c768d361d3d17c |
| SHA512 | f59de04e1f8ee3f028e4d82b895369c2aef8363a9d86c1c7f0de3c8f803f2d740da4c30a7b5b6af85f8fec8f3b4695b437aecf4091e32039835fe2659f4d841a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | d4aac83192823778a83431f72d0e4804 |
| SHA1 | d8fdb534d7c5cb6cc4061aff96ddffd51bfb7e8c |
| SHA256 | 8414fa892cc679a994253d3d359cc674a144de902f7b59ef10db106a857e0b78 |
| SHA512 | 796616cf1959405db3fc1b3477149f0c1e73fa2d664393272efa6f2b0823514fb8f373ad9282c716694a4d072e6b300dc0b3bfe9f2255367313df2e2bf73ec38 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 1d4c996793a3a38f2086c78dbd5b19a4 |
| SHA1 | 53425c3a7fc3daca045f26c7f98e2a9ba64b34cc |
| SHA256 | 4ed1d052e9a968291e0ffeb654ad6dc01271a0d4a3feef41ec5d33fe2532b716 |
| SHA512 | 63dfdde04effd2d8768190d5e50bf53ad6399621a541b3ff9e1b3bf4cab292b611a7bef4b9f384caf0abaed3ac5375d4fd6f543fd74c099d9d0926785bcbfda1 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 7ebdaa56256ec1c735a3d8fd2961596e |
| SHA1 | 46f9231444cf2448063acc66313590e3afd5d4ae |
| SHA256 | b24c14c6fd6ae67dd8d82b3f35f9e5bc349b204df9ddaecb8ffe5ee5910c7d8e |
| SHA512 | fbdceaf81fe7be128459ba8e60ce97807fd3f02653dd48e2bf66353d40bf09fdd599baedc6dae77a191898fccc74376f2a2d0a9cc65d55d48c643a30da88b0ba |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 54aaeff9c51200a5f97b3a5e67ff9c60 |
| SHA1 | cb60050303b788eca59f18917590e787a8b3d322 |
| SHA256 | 13ee1faaf819ebb03dfc6e5605c282da21d904819c495c45e8731c90daa2adb8 |
| SHA512 | ab4532c8aa452c30edd5782d369750fce16f62e3b21039138a5b79dced8506f75aacaa8ffe6560f96c3e2d851f50a175de83becdeb46d50ae2a6849a71f89a69 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | fe3f8f5d92a7d08771365009384389ee |
| SHA1 | 348655153f748d9bc1b6dd0f3e875eef80a6917a |
| SHA256 | 9b800009163ff9bf3a388fbf61d1359c340e435c82c3a993613bb0237715a05c |
| SHA512 | 3178c6870d8836a17ec8fec3bd6c9f8dadec0592226732cc9ea0d6cbb8298306360dcdd0512f7dc053ad8905421fd7842365c368476e323d96134bb3fdeb787b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 178df80582178bc2b5a8ec22c8f95131 |
| SHA1 | 9670a7fc3add5875b236b89cffc317a551c899be |
| SHA256 | ee799db489cc35f5ff8c56d2e7f22ebf0d475521888bb0f9fd319c0c790253f6 |
| SHA512 | 69323c4d33da629081f7efe7279a1efce0bde53382e65178407710d548094040bc9a2236c46ef21d2ed0a71b954f9b09160f7d1af1a803fb66d470b9879d1c46 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 1b85a63c81b1b826395b96f632735fed |
| SHA1 | 8dcd49df518cd87fa0adf24387b0183f6fe089ea |
| SHA256 | 5c9fecd14f3fe5163961b94070479c20b98076c5b813486028067646023e01b3 |
| SHA512 | 8d766a5efef052b3706ec1bbaacbbff91c415a9ad56db6de1af816c50af67999bbe76a28bf5d38b3dd9a7a74e5f1b24aca57db0dd1865dd942f8c93b2db8a1f8 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 1f393234eccee5da33c984d64be1855e |
| SHA1 | 9a53667e8c5257144e24625b0ba07461b03ceec6 |
| SHA256 | 774eebf97adced8b0d436070c9b41fd355b47cc22683f8fee12950527dbec0b5 |
| SHA512 | f0c538299f30b1802da1f55a97c8430bc9588bf60824b492895b757cb2a147a79e616676086444966a8e7208c0023cb104149f84641a46be08c851b306551343 |