Malware Analysis Report

2024-07-28 09:11

Sample ID 240625-r5legaygrl
Target https://atemzeit.fem.jp/gt/?wptouch_switch=desktop&redirect=https%3A%2F%2Futm.kadiapack.com/trans/[email protected]
Tags
phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://atemzeit.fem.jp/gt/?wptouch_switch=desktop&redirect=https%3A%2F%2Futm.kadiapack.com/trans/[email protected] was found to be: Known bad.

Malicious Activity Summary

phishing

A potential corporate email address has been identified in the URL: [email protected]

Looks up external IP address via web service

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-25 14:46

Signatures

A potential corporate email address has been identified in the URL: [email protected]

phishing

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 14:46

Reported

2024-06-25 14:48

Platform

win10v2004-20240226-en

Max time kernel

118s

Max time network

124s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://atemzeit.fem.jp/gt/?wptouch_switch=desktop&redirect=https%3A%2F%2Futm.kadiapack.com/trans/[email protected]

Signatures

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133638004226665042" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2604 wrote to memory of 856 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 856 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 1096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 5108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 5108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2604 wrote to memory of 2176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://atemzeit.fem.jp/gt/?wptouch_switch=desktop&redirect=https%3A%2F%2Futm.kadiapack.com/trans/[email protected]

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd77c29758,0x7ffd77c29768,0x7ffd77c29778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3256 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5296 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2660 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2820 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4c4 0x390

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5960 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5708 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5688 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5776 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1644 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5716 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3748 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4088 --field-trial-handle=1712,i,16419342867601736486,15937246262055511667,131072 /prefetch:1

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39a9855 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 atemzeit.fem.jp udp
JP 118.27.125.183:443 atemzeit.fem.jp tcp
JP 118.27.125.183:443 atemzeit.fem.jp tcp
JP 118.27.125.183:443 atemzeit.fem.jp tcp
US 8.8.8.8:53 183.125.27.118.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 utm.kadiapack.com udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 162.213.255.21:443 utm.kadiapack.com tcp
US 8.8.8.8:53 21.255.213.162.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 wolfkran.de udp
US 68.65.122.113:443 wolfkran.de tcp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 code.jquery.com udp
US 8.8.8.8:53 stackpath.bootstrapcdn.com udp
GB 172.217.169.74:443 ajax.googleapis.com tcp
US 151.101.130.137:443 code.jquery.com tcp
US 151.101.130.137:443 code.jquery.com tcp
US 104.18.10.207:443 stackpath.bootstrapcdn.com tcp
US 8.8.8.8:53 113.122.65.68.in-addr.arpa udp
US 151.101.130.137:443 code.jquery.com tcp
US 8.8.8.8:53 images.ctfassets.net udp
FR 18.244.28.109:443 images.ctfassets.net tcp
FR 18.244.28.109:443 images.ctfassets.net tcp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 104.18.11.207:443 maxcdn.bootstrapcdn.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 8.8.8.8:53 74.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 137.130.101.151.in-addr.arpa udp
US 8.8.8.8:53 207.10.18.104.in-addr.arpa udp
US 8.8.8.8:53 109.28.244.18.in-addr.arpa udp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.153:80 apps.identrust.com tcp
US 8.8.8.8:53 logo.clearbit.com udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
US 3.165.113.129:443 logo.clearbit.com tcp
GB 142.250.180.10:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 207.11.18.104.in-addr.arpa udp
US 8.8.8.8:53 14.24.17.104.in-addr.arpa udp
US 8.8.8.8:53 153.101.63.23.in-addr.arpa udp
US 8.8.8.8:53 129.113.165.3.in-addr.arpa udp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 17.201.222.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 31.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 wetransfer.com udp
FR 18.164.52.17:443 wetransfer.com tcp
FR 18.164.52.17:443 wetransfer.com tcp
US 8.8.8.8:53 cdn.optimizely.com udp
US 8.8.8.8:53 frontsite-nextjs.wetransfer.net udp
US 54.231.132.130:443 cdn.optimizely.com tcp
US 8.8.8.8:53 logx.optimizely.com udp
IE 54.76.93.251:443 frontsite-nextjs.wetransfer.net tcp
IE 54.76.93.251:443 frontsite-nextjs.wetransfer.net tcp
IE 54.76.93.251:443 frontsite-nextjs.wetransfer.net tcp
IE 54.76.93.251:443 frontsite-nextjs.wetransfer.net tcp
IE 54.76.93.251:443 frontsite-nextjs.wetransfer.net tcp
IE 54.76.93.251:443 frontsite-nextjs.wetransfer.net tcp
US 8.8.8.8:53 help.wetransfer.com udp
US 8.8.8.8:53 we.tl udp
US 34.49.241.189:443 logx.optimizely.com tcp
US 8.8.8.8:53 wepresent.wetransfer.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 wetransfer.zendesk.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.instagram.com udp
US 8.8.8.8:53 www.thesupportingact.org udp
US 8.8.8.8:53 17.52.164.18.in-addr.arpa udp
US 8.8.8.8:53 251.93.76.54.in-addr.arpa udp
US 8.8.8.8:53 130.132.231.54.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 189.241.49.34.in-addr.arpa udp
US 8.8.8.8:53 assets.ctfassets.net udp
FR 13.32.145.4:443 assets.ctfassets.net tcp
FR 13.32.145.4:443 assets.ctfassets.net tcp
FR 13.32.145.4:443 assets.ctfassets.net tcp
FR 13.32.145.4:443 assets.ctfassets.net tcp
FR 13.32.145.4:443 assets.ctfassets.net tcp
GB 142.250.180.10:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 4.145.32.13.in-addr.arpa udp
US 8.8.8.8:53 snowplow.wetransfer.com udp
IE 99.81.239.33:443 snowplow.wetransfer.com tcp
FR 18.164.52.17:443 wetransfer.com udp
US 8.8.8.8:53 33.239.81.99.in-addr.arpa udp
IE 99.81.239.33:443 snowplow.wetransfer.com tcp
US 8.8.8.8:53 videos.ctfassets.net udp
US 8.8.8.8:53 tagging.wetransfer.com udp
FR 13.32.145.4:443 videos.ctfassets.net tcp
US 3.165.113.113:443 tagging.wetransfer.com tcp
US 8.8.8.8:53 geoip-js.com udp
US 172.64.154.146:443 geoip-js.com tcp
US 8.8.8.8:53 113.113.165.3.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 146.154.64.172.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
US 172.64.154.146:443 geoip-js.com tcp
US 8.8.8.8:53 152.74.67.172.in-addr.arpa udp
FR 13.32.145.4:443 videos.ctfassets.net tcp
US 54.231.132.130:443 cdn.optimizely.com tcp
US 8.8.8.8:53 cdn.wetransfer.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 229.65.101.151.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 public.profitwell.com udp
FR 18.155.129.119:443 public.profitwell.com tcp
US 8.8.8.8:53 119.129.155.18.in-addr.arpa udp
FR 18.164.52.17:443 cdn.wetransfer.com udp
US 8.8.8.8:53 wetransfer.pr.co udp
US 8.8.8.8:53 auth-session-caching.wetransfer.net udp
IE 54.76.93.251:443 auth-session-caching.wetransfer.net tcp
US 8.8.8.8:53 privacy.wetransfer.com udp
FR 52.222.169.123:443 privacy.wetransfer.com tcp
US 8.8.8.8:53 123.169.222.52.in-addr.arpa udp
US 8.8.8.8:53 experiments.wetransfer.com udp
FR 3.162.38.39:443 experiments.wetransfer.com tcp
FR 52.222.169.123:443 privacy.wetransfer.com tcp
US 8.8.8.8:53 39.38.162.3.in-addr.arpa udp
US 8.8.8.8:53 analytics-v2.wetransfer.com udp
ES 52.84.66.123:443 analytics-v2.wetransfer.com tcp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 e-10220.adzerk.net udp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
US 52.202.104.177:443 e-10220.adzerk.net tcp
US 8.8.8.8:53 123.66.84.52.in-addr.arpa udp
US 8.8.8.8:53 2.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 177.104.202.52.in-addr.arpa udp
US 8.8.8.8:53 checkout.wetransfer.com udp
US 8.8.8.8:53 collector.brandmetrics.com udp
US 8.8.8.8:53 privacy.audienceproject.com udp
US 8.8.8.8:53 privacy.basis.net udp
US 8.8.8.8:53 site.adform.com udp
US 8.8.8.8:53 www.adobe.com udp
US 8.8.8.8:53 www.amazon.co.uk udp
US 8.8.8.8:53 www.beeswax.com udp
US 8.8.8.8:53 www.captifytechnologies.com udp
US 8.8.8.8:53 www.celtra.com udp
US 8.8.8.8:53 www.scorecardresearch.com udp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.147.23:443 connect.facebook.net tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.redditstatic.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 bat.bing.com udp
US 8.8.8.8:53 s.pinimg.com udp
US 8.8.8.8:53 cdn.treasuredata.com udp
US 8.8.8.8:53 js.adsrvr.org udp
US 8.8.8.8:53 c.amazon-adsystem.com udp
US 151.101.193.140:443 www.redditstatic.com tcp
US 13.107.21.237:443 bat.bing.com tcp
US 151.101.188.84:443 s.pinimg.com tcp
FR 18.244.32.109:443 js.adsrvr.org tcp
FR 18.244.28.65:443 cdn.treasuredata.com tcp
US 18.245.194.122:443 c.amazon-adsystem.com tcp
US 8.8.8.8:53 nolan.wetransfer.net udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 140.193.101.151.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 84.188.101.151.in-addr.arpa udp
US 8.8.8.8:53 109.32.244.18.in-addr.arpa udp
US 8.8.8.8:53 65.28.244.18.in-addr.arpa udp
US 8.8.8.8:53 122.194.245.18.in-addr.arpa udp
ES 108.157.109.104:443 nolan.wetransfer.net tcp
US 8.8.8.8:53 rum.browser-intake-datadoghq.eu udp
US 8.8.8.8:53 s.amazon-adsystem.com udp
US 8.8.8.8:53 di.rlcdn.com udp
US 34.149.169.145:443 rum.browser-intake-datadoghq.eu tcp
US 52.46.155.104:443 s.amazon-adsystem.com tcp
US 35.244.174.68:443 di.rlcdn.com tcp
US 34.149.169.145:443 rum.browser-intake-datadoghq.eu udp
GB 142.250.178.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
GB 163.70.147.23:443 connect.facebook.net udp
BE 64.233.166.156:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 pixel-config.reddit.com udp
US 151.101.193.140:443 pixel-config.reddit.com tcp
US 151.101.188.84:443 s.pinimg.com udp
US 8.8.8.8:53 alb.reddit.com udp
US 151.101.193.140:443 alb.reddit.com tcp
US 151.101.65.140:443 alb.reddit.com tcp
US 151.101.65.140:443 alb.reddit.com tcp
US 8.8.8.8:53 eu01.in.treasuredata.com udp
US 52.46.155.104:443 s.amazon-adsystem.com tcp
DE 3.68.247.154:443 eu01.in.treasuredata.com tcp
DE 3.68.247.154:443 eu01.in.treasuredata.com tcp
US 8.8.8.8:53 104.109.157.108.in-addr.arpa udp
US 8.8.8.8:53 145.169.149.34.in-addr.arpa udp
US 8.8.8.8:53 insight.adsrvr.org udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 104.155.46.52.in-addr.arpa udp
US 8.8.8.8:53 www.google.co.uk udp
US 8.8.8.8:53 w3-reporting-nel.reddit.com udp
US 8.8.8.8:53 68.174.244.35.in-addr.arpa udp
US 8.8.8.8:53 156.166.233.64.in-addr.arpa udp
US 8.8.8.8:53 140.65.101.151.in-addr.arpa udp
US 15.197.193.217:443 insight.adsrvr.org tcp
GB 142.250.200.3:443 www.google.co.uk tcp
DE 3.68.247.154:443 eu01.in.treasuredata.com tcp
US 8.8.8.8:53 match.adsrvr.org udp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
GB 163.70.147.35:443 www.facebook.com tcp
US 8.8.8.8:53 ct.pinterest.com udp
US 151.101.128.84:443 ct.pinterest.com tcp
US 151.101.128.84:443 ct.pinterest.com tcp
US 151.101.128.84:443 ct.pinterest.com tcp
US 8.8.8.8:53 cm.g.doubleclick.net udp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 dsum-sec.casalemedia.com udp
NL 185.89.210.122:443 ib.adnxs.com tcp
US 172.64.151.101:443 dsum-sec.casalemedia.com tcp
US 151.101.128.84:443 ct.pinterest.com tcp
US 8.8.8.8:53 154.247.68.3.in-addr.arpa udp
US 8.8.8.8:53 217.193.197.15.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 84.128.101.151.in-addr.arpa udp
US 172.64.151.101:443 dsum-sec.casalemedia.com udp
US 151.101.128.84:443 ct.pinterest.com udp
US 8.8.8.8:53 lebowski.wetransfer.com udp
US 8.8.8.8:53 cdn.brandmetrics.com udp
IE 34.241.136.138:443 lebowski.wetransfer.com tcp
US 172.67.69.191:443 cdn.brandmetrics.com tcp
US 8.8.8.8:53 101.151.64.172.in-addr.arpa udp
US 8.8.8.8:53 122.210.89.185.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 138.136.241.34.in-addr.arpa udp
US 8.8.8.8:53 191.69.67.172.in-addr.arpa udp
IE 34.241.136.138:443 lebowski.wetransfer.com tcp
NL 20.50.2.28:443 collector.brandmetrics.com tcp
ES 108.157.109.104:443 nolan.wetransfer.net tcp
US 8.8.8.8:53 www.datadoghq-browser-agent.com udp
US 3.165.111.23:443 www.datadoghq-browser-agent.com tcp
US 8.8.8.8:53 28.2.50.20.in-addr.arpa udp
US 8.8.8.8:53 23.111.165.3.in-addr.arpa udp
US 8.8.8.8:53 backgrounds.wetransfer.net udp
FR 99.86.91.32:443 backgrounds.wetransfer.net tcp
US 8.8.8.8:53 prod-cdn.wetransfer.net udp
FR 18.164.52.48:443 prod-cdn.wetransfer.net tcp
US 8.8.8.8:53 donny.wetransfer.com udp
IE 54.195.10.151:443 donny.wetransfer.com tcp
US 8.8.8.8:53 32.91.86.99.in-addr.arpa udp
US 8.8.8.8:53 48.52.164.18.in-addr.arpa udp
US 8.8.8.8:53 151.10.195.54.in-addr.arpa udp
US 34.149.169.145:443 rum.browser-intake-datadoghq.eu udp

Files

\??\pipe\crashpad_2604_HZMJYBZWJYBWPHAE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 11cb67956714ad10e28bdb46fc6e6df0
SHA1 d3cca459505bae9d9986a3a03e5a8cf76e9de36d
SHA256 86e40bfaf1f5e7cf5202d08298074f373131fc78a5c82d57e8bb9c83d774b7e2
SHA512 20a4be294628f249f4681695470bfb4789a4811506a31ee392836bb508ea080e4a811b0892558a1f7511da1930b218003ca31361034ca0d2271b1bfba83e0118

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a91fc925deb6df7da195079765228187
SHA1 c85c0196b6d3d2bfae4a0387e08e4c81ef83b996
SHA256 ee591aa22edc66217835683f2cf54d71a0c0b465fc739625cc1fa7f33e0974da
SHA512 16cb984a405ac8dbd6b3bfe2bd5b233252c17e75e4eac397c0d9dab42688582e7dbb0eaed31b6a74f3a9d9d82f3afc34ad9d270ed0514b48a16903409c445280

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 9c861ac0c9fdb23338fca96a62dc22cc
SHA1 1dd28088484153ae8872a097688e2776ed8a7423
SHA256 d11c4f0f5ab1a2d6deb8ef9ee9796cee78ff66bf6ac4d05fc3ea86a798fda82e
SHA512 b50ac2c70534a1da6aee1993610e9eed77caf9b6ddb019da438af1c782b29ac2e112fa86fc0aa14ff33a76f3c73e47d28f39ca3a9c7b5df9f1641f79d4a90ef3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a94978672894da4c33568f0375ae5820
SHA1 ed5c573a27a38c905b05fc490b27385a3f1a7949
SHA256 bfdce6a82e226f5f2a3d6757f17f1a0fd6390a55bde91636fb7e94a0fd1c399a
SHA512 8a61083182b2762f604350fcf861c71a968f5eced0745b235acc71134fa7738c6e66feba5a76ab9f487d7f2260bb425fc45900244c6b4c6cbc46d3f3e0014578

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ebf129daf8f826f069009cda6765f1a9
SHA1 7f42ac5a0d6bdbb211c133acc45f18e8a24c5755
SHA256 67fced0c99a90151f1118f0bf934062d91e9e1d47855f06d6d8ecb52d207ed10
SHA512 1683cb3744d47bc0dcec83a72dfe0c467605355a4c8c3694089b77c2604acdee33dcec249e87e2d0cff5273bf9fe0845aa37e36a8fce72db58facebc87a8bb33

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4248b18bc07295b25f0be7cd63e9f882
SHA1 c71ead31f3ec78aeb09f5f9118ac4bcd86870469
SHA256 4168c7d98b8d4e8df6800b760d0af7c9c793f7e31dd1f336b0dcaea64b97d6e8
SHA512 5cc3e002167e3c2af5dd8057e38e3d0fe972c7b38e3c81d81d72c432b475e2e2b255982e492270608b50b7fe8bc702ac6921d1976f3ece447d8335d3ce3e65b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 f1f951af8188078654fb6d173f6350f6
SHA1 24c3c0e8b8d6598506cbe917a644242e06bd99b2
SHA256 8bc0222b03789da7974be803d79010732106ce7042ba9bcb45f7b7655c95cfb6
SHA512 d979d00aa51e49e102fff0380d9964accd24c8547165c43afb2eb1035920818a461e2370bf1da16ab7646af529b654f74bb41d67b96167bd5a1eb4e68a462419

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

MD5 4c332dd2ebf80a0ad19e2bdd3d9cff37
SHA1 1c21b8052b966b4ab12b5a06ecab74be47321ccb
SHA256 930a1add99fda61f70e8d1c44e4dfc1fea13e7afdd461f0d9c21b95de8847696
SHA512 38b4fe169257cadf0f0cc4c17b8ca68d7cbe62651eaf5884176b2bf4af7bb580f308d1d990cceab4e3cfde74dc4645bbbc6b486d718ab7a14d8365ae2e5b8259

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 8ea0f65f394c98a0d87e77a258d18f49
SHA1 08f323848573b2f07a35de3c0a94aaafefd828b6
SHA256 914b6db5add982eaa16167aac337c90718fb5e612776e6e24a16c443731169f8
SHA512 ebf160a2e0c14c97ced836a79f9a76473627e026bba50dc5400f1b18acb6f3aa1cc0b2e77bad3e3d799a0e9e0a357a03d84b0c353dbccefd236cd73ed30edbd3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 14b6179dce2e1758476f43a0ad0ddd96
SHA1 9377cb5bd94fd690b8115f08aea3ac6fde1867a8
SHA256 de835bb1a013bf09a5ec97200fb02918a37f3505dffa3b601b0e762aec34f93a
SHA512 ea21e42cd9211a959d2f542bf79ef9d2c1ad19c60d796f958c4fb88a75b3d05b05f5b9bdf1b3550bcb58772c662d30480ae177086739fa6f26fcb6e7a36151df

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 aa172edc7426b94f1115693983031167
SHA1 78b09a8d20f44041f8726b320529ff95762c9abd
SHA256 934130b22f60ae240e1b63fd256421b1cca6b204274f2bf03ff82cdcbd95e81d
SHA512 a06d2107d8b6f2dea9c384fb406d2522eb14851c29683a16ef7f5f4644a094ae184df08af017e2782e2670d45413fe3923dc05c7270ab58f7dae3a0dc8f17e92

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 ba3bfe18a9e193f0653a2c6eaf3539ec
SHA1 4d883d0d40c6d34f03411b04471b121c1eb1d46e
SHA256 bf935edd3ae2f1be28d6799556af4a28aaed2eacd17d49de24a20d98ef09a900
SHA512 c13eb535befedf706c8b6a9bcc42f15ff7c89617ac9115b2d4853a14464bbbbead9e4dc72ffae95bed86b0c045c24605746a66b9b83ccdefaf1ed121fa0b6bd4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 18cadebd25c93fd30dee80232ed4e62a
SHA1 970631c6698fc072fb416f6fb7da84e12ce1da34
SHA256 62f05f0d6d2fa627cd3e91a2134674cd0a3fa6248129a8289735095b79380b57
SHA512 493879baa7ca3ab7d5b3f9c623c43ffd31f51b54361f40e6ea1416864308a672f43984015aa7b31a3d12907bea0b6dc910b5097e3a595cf0363cc3e7efe4986d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 86ad22aea9186398883f290949325745
SHA1 f3c3bc3b962381dbc43529bcfc374fd682ea9b9b
SHA256 b2c508ae984e0878195a48a0fc253f7852a0898cc0c04280a40aea31b06d4e8b
SHA512 b85a0823396bd1b60d521d6ec21ff83f9d55094b561ef2c83d427754a3d472e1dc2a6c9d84cae0eba4def167e68cbbde0ee4ac08debaab9d89b46e69bd881bae

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 aed9f00187bf6f9f51095d1c63cc34bd
SHA1 75385c2a8554da066b3af0112daa85c41f48f167
SHA256 a46ff14c3e32388bca63926f9aa783635267ab6e576218ace941bb1cf03e58a5
SHA512 8f9819d2ea5f16e256aa3ca7a25f8d6f9b89c274972e49991ebd3d4cd718e7b5e226545f77ff43bf76e01fc948a1778ee1347f392cdae5ebff4c82dadcabc3bc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cf036111f3f25ac490d742d3fc8f6a11
SHA1 b7c3550815abe9128d77a37a1058c03092eddd07
SHA256 666193a9351b3a22affb4821a9d53c6c9c04e65e9afa950fe6caf52549506d8c
SHA512 190f13a6fa55f88532049c2e30751a4d2af4bf7bb2cf147ce24704fb09d910c63972432c2338bcf89a66a2cf44faa5ece34cf6b7d7c7b6fa18f611d36507f053

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 3f97607fd2c66fc718fdd0cdf5e78eee
SHA1 c0bc9ed80829f0a82f966869516cfce44ab7b841
SHA256 1f1829dcf3766dfc5640e859b3f9ecc91ea9feb0229d9979bec6c75c69e4e404
SHA512 2c94cf57d966924e7874291283ad6406df72a2a45f7ce49d04792bbfcd1e492d746a62da9ae163b5f7a440613cb0833bdd807e3c4f5f8d3b84c6112a4f05d295

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ecdbabf9e2ee8818c99fc43b493f719d
SHA1 4dc829915d5d1e7cd3974fd7b6c30b7360129e1c
SHA256 0a9448bf075cff8bd7aff37935e8e83c5c64a4696d3101887462b463195eea3a
SHA512 ec19c5ba2efab146eede0de8ac2344f9a0543cdb94be4039ede06efa22816bb6c26e3cb5150f91ad6e7efb197baec6a873d9eccb04132b6f566b3609769c3547

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 7bb90f2cd50f006f440e94247c975681
SHA1 70fe0db894c522b478e5bffd1f97737eca3db42e
SHA256 f3aee60172b86b8465cabedb70c782449dd5f62b3c7f7f843c88e74a24959aac
SHA512 40024ebf24e1500ae68951ce97e9af689c2caa1015e2922e80c8ab633f7567a6f50edf47dddca7395a01df3659571cfcdb1b49a3902e68c440fa283ffa684a24

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 a76c88a26d7e01cf249348a2525d07db
SHA1 777f3adf83dd123eba28322e13b7e1ca413a7d4f
SHA256 54fbd7404b04296af705bcc8007bddd16aa8b89289669f1bd1fbea97a27d1bbe
SHA512 7c5278d5241f95acd5abfc95b1bd58c5bb06cd7bcd946e7c43031d898423e27066a26111ec7bff6a1c93f6d37930bb8feaa1a6b671b3f950fbda155b86978c21