hxxps://start[.]usvisaconnection[.]com/

Analysis

user interaction
yes
max time kernel
210s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 21:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://start.usvisaconnection.com/
Sample260604-1n89msgw4p

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	ipapi.co
47	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4828	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250833479033320"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
1568	chrome.exe
1568	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2604	4380	chrome.exe	86
PID 4380 wrote to memory of 4440	4380	chrome.exe	88
PID 4380 wrote to memory of 4828	4380	chrome.exe	87
PID 4380 wrote to memory of 4440	4380	chrome.exe	88
PID 4380 wrote to memory of 1820	4380	chrome.exe	89
PID 4380 wrote to memory of 1820	4380	chrome.exe	89
PID 4380 wrote to memory of 2524	4380	chrome.exe	91
PID 4380 wrote to memory of 4172	4380	chrome.exe	92
PID 4380 wrote to memory of 2524	4380	chrome.exe	91
PID 4380 wrote to memory of 4172	4380	chrome.exe	92
PID 4380 wrote to memory of 2660	4380	chrome.exe	93
PID 4380 wrote to memory of 2660	4380	chrome.exe	93
PID 4380 wrote to memory of 4872	4380	chrome.exe	101
PID 4380 wrote to memory of 2652	4380	chrome.exe	110
PID 4380 wrote to memory of 2652	4380	chrome.exe	110
PID 4380 wrote to memory of 1056	4380	chrome.exe	111
PID 4380 wrote to memory of 1056	4380	chrome.exe	111
PID 4380 wrote to memory of 1524	4380	chrome.exe	114
PID 4380 wrote to memory of 3692	4380	chrome.exe	115
PID 4380 wrote to memory of 624	4380	chrome.exe	116
PID 4380 wrote to memory of 1568	4380	chrome.exe	122
PID 4380 wrote to memory of 884	4380	chrome.exe	123
PID 4380 wrote to memory of 884	4380	chrome.exe	123

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://start.usvisaconnection.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb4ca8c728,0x7ffb4ca8c734,0x7ffb4ca8c740
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,10075073382212155531,4600914438520169392,524288 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,12048617668586994984,3748233606533705144,262144 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1564 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,6060554810766707278,401218218364819424,524288 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,11406796943029277721,15162005696629660714,2097152 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,11506812053094441941,12316222749866570580,2097152 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,11325091401135586691,16525619330213638995,2097152 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,14647641394557500779,6855399947544306645,524288 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5700,i,3614260934786910406,3315374941638835470,2097152 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5592,i,14168479198913296125,15828518059386872517,2097152 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4312,i,7564939994529158066,1082265899803789108,524288 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,3607885639442795376,12245746736847727235,524288 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,18295918290739511281,4167299385017148273,524288 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4424,i,5814584603479592589,13339730721698451207,262144 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,2233123041328345012,9663455920710613336,524288 --field-trial-handle=2036,i,9027158812854455389,11199508022206143523,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ffd07c223894b837e01d8c43f27ec535ed9f7aa19ff306d7e55d36355354314c
MD5 1016993970bcf83cff3304337bb1a3b1
SHA1 589368af9ee9953bfe8f9ee908a86c4ae9349a97
SHA512 e5c14ca7ac8829abb865b34efb69ba7ce97c7ebf4ebbbf862c97fc6f444dd77ec6d8367fa3682fd8c3425f2afb68ca572e75669fe0047ae0ecb94ec1d08acf31
TLSH
T185F0F4B5DD22AC3718FC172874A94B0AE75113572741989F3B3D920C8FB4B3B468A85C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e9b4166cafa334b16a72aa48184dff0357cd1192f33026a9bdbd8640a8497cf2
MD5 bb54070ae8b898e89f82d5a0bf470e8f
SHA1 e03095ab599366c900092a0401c3726817e42f42
SHA512 2001978c5f93c60a365e7dd837c5c0eb2612a4336d243fac166fdf05a6f578257cbd014581fb8f204cea73150f98f9a3bca466bdc686d4e245d78a05cc7a1e3a
TLSH
T14941A8DB8DC10228EFA52430FCEE0914BBB252F95603BEC2C9D827B444D779D2A4D542
MD5 SHA1 SHA512 TLSH

Submit Download

56f01a1e-13f7-4a47-932e-51eedbe9c110.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\56f01a1e-13f7-4a47-932e-51eedbe9c110.tmp
Size 7KB
SHA256 349e7f07dc09ceff8d53f2ea14ccd445f1a2cc36d82b94763961dfdde58ee671
MD5 0c9202af60a4f5434bdba20fe1a94da7
SHA1 993ed4cac4f631fe054aec8d8a9b6e33ee305f17
SHA512 b2bfd66c80edac366a93e769461491886041d9944cadce2a1f04735fbbed8a4f7e79da7bdcf20d9a19f2ebc5048cb0ca54a7f915bf7f93f637e7e0ec250da873
SSDEEP 192:DCMReFMSytTS+fcg2bFvFINNfFVRFdLR2o4u5LDotB:DCMReFMSytTS+fcg2bFvFINNfFVRFdLc
TLSH
T1CFF17EE3C3E4DE6D9A1157F0AA246E27DE5D0964632C3C4EC4DCAE5B67F14B0D24068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2bb897d659a7f1dd70257738445b4cf4c4f8620d28bbac06139c1fadd3998d8e
MD5 9056e1833dd6b10eab9779c9045e4278
SHA1 ebd6fe92e72f58f981d042ece7af9f52e1fdf4de
SHA512 febb0bffe79eb054181a4a005f1622c10802cd70b3d34874638238f45c0aeb194903b0480d747d1f3b485a846ec2ae0e20c51153ced6d64d79ffcab9097829e3
TLSH
T1964148F7C7E8897D890196F4BB152E1FCE2A0E14576C3C5AC8D4AE0B53E28B5D24068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f291cf3c64bf304c02adfdddda166b8dd7ad2dd0ca79d6e50344ae5824aaf77b
MD5 c8cc43b9952dd9fa2056dd8f3cb2a83c
SHA1 0838a6e1294a53a6e7fb2079565533b8d6834f7e
SHA512 9cc8a53928e279ecc1bea19b9d876f32c6b860cb2323f3107135dcf22de418e8eb14c6323163ec46accd916ad09817789aa7e952d456e6887da2db56fe6fb5be
SSDEEP 192:FRIJXXHkwwasmlv7MF+pAPRp2Gm9HHsb+WNnKCXesD2ZtDgkwFoVyIsnAUge:FRIJnlVgoUXA1wVXB2Qee
TLSH
T16C42C82EED1529BB6CCBC229FD16BB57D7F5102121D01E88EAFC8A1C15E76CC221745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 986d43971b5c0a1bba471b85154fbcb159d97ed6a47cdb8f52a65340564d2dab
MD5 a3c7a0dc4207a62a05a70842e4b80b92
SHA1 4a7151890a30da810f886bbb94ee188be65220aa
SHA512 1a48545e537a592a16834e635cd6021bc717de686ce9b8dc23a76de3b5e08083a5d9c54be2fccb78b57e5aa39672699f8b014e95e26d4120747a783f87cd65ae
SSDEEP 192:FRIJXXHkwwasmIv7MF+pAPRp2Gm9HHsb+WNnKCXeVyeKtDgkwFoVyIsnAUge:FRIJnlUgoUXA1wVXpeNee
TLSH
T1EC42C86EEE1129BB6CCAC229FD16BB57D7F1103121D01E84EAFC8A1C05E76CC221745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2ddd716098269a95a48b3b77c01435aa5eb187572e83a89d2dfaf9b98f1267db
MD5 d6dd895769f42b9f5fb0dcdea883de15
SHA1 2026c40eb528969968b7d93b7c260c47f48b29ff
SHA512 f62ee36e9c37a9d88a28f62acc964bb33a70837eeaa47d794116b4069c7cd34452474ec3b53a40d2fac6e16753b7018dd808ba76e35d186c5ea5d5ee4dc331b3
SSDEEP 192:FRIJXXHkwwasmPv7MF+pAPRp2Gm9HHsb+WNnKCXeVyeJtDgkwFqVyIsnAUgE:FRIJnlHgoUXA1wVXpegUE
TLSH
T14642C76EED1129BB6CDAD229FD16BB17D7F1102221D02E84EAFC8B1C11E76CC221745B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 913476bd12a6aab34ec0f40f93ad842a77b37dcb4d145b0af477b43a5b61ebf1
MD5 abb3e2158a16c1fda0b41498ce646d20
SHA1 96ea4f3189656e8f90c602676656c634c2a80575
SHA512 ce4d4e2a33d94206d79b4716c36eb0eb43961efd6026a0a9a254533cca6f9f70dcf14d7bfb444f0ebae09f386bc31f3db6689980874e550ab6464113eb3510ab
TLSH
T1C8B0124184115112C4060EF4114714887214AF60E60F2701D3E0A9238C251A1802C0A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588b43.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588b43.TMP
Size 96B
SHA256 911eb73b3bf8d2d7e92788ff65b13a40d7ab790bb2d72cf0b158f1aa8cf98360
MD5 1be73fafb8cf52be8134e892a555a7ff
SHA1 b0cfc7c28c4f2950b17c1fff175e9773fa06d856
SHA512 6dc66de9f222d19f9188a75969350824d8650ac65787b6d12413aa05f732aaa681fbb4faa883b16241c427b894a5265f86aa2f0d10708ff258fcbdbd82197a93
TLSH
T1EEB002A5C102A216C44207B02D95E6E871B5EF26D603B71BE3E01F76DC256A495255B1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 90c81cf93c76988a4b5e0ef0f8a40949884ea880e139f344707115d314aab36b
MD5 efe1c1f4d2e0412bd720e07aaf7d9b39
SHA1 f2aaaf4e4a8fd6499b88ce94e4011631a5735a0c
SHA512 9a995bb704fee2e796a9c1ce0dd8688d59d836e823ccea6ba0c0ec2860843d54dc2e9b27c7c97de31631026b660c0c9b6960d04a33c3d1e8da544892aefca108
SSDEEP 3072:qmGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:qRm7Rkm1tYpBeh2BAoM
TLSH
T158C312275D75E83759B9BB1EB08E0B1F1EF14AA6C930DE91C8D85B0423FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7e5fa3cfe69ae9defcb9692e3c9e9cc4f7081a67ab399a089e57428600658d02
MD5 9348cbca80e5a876095c47f500da4d7e
SHA1 2c55b3ecb9ab4a4db5c3b7a31abb09130564599d
SHA512 1c64704adf3f2de39879bd020ce2507ca18fc558c49dfc43647d2d7ffeef26e466e418c4fc14e444974a7bea119be7608caf5598f9644f27dd4bba56c4cfdec3
SSDEEP 3072:/RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Am7Rkm1tYpBeh2BAoM
TLSH
T120C312275E75E8375878BB0EB48E0B1F1EF14AA6C830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 168KB
SHA256 3a2c6a2f1c2b7939cb84953da5eeeac36332961513413bda6c36c02bbb70c6ac
MD5 33f4f575a51ba02ede3930e2413e182a
SHA1 eb9f3ceaf73bd301afe5bb24a3280aa3169d3606
SHA512 993cda8c89561ee86ebc847d029605b9a57e2e7a2d40867d854e6301fdde54b24f803626d40d14b059c6c8ebca581ba991400cf76357235a27ad20e025a5997f
SSDEEP 3072:qmEFGO/Gl3wJvW4ozGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:q+O/G0W4Xm7Rkm1tYpBeh2BAoM
TLSH
T161F312378E70B8B9A8A9B70FB44F1B1B1DF149A7D920CA55C8955E0823EEBCC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ce1368d970e0740a7ea559a320303a72249f26e7f99e1e1cc338bd0ab75f633e
MD5 d43bf6f6d5388d7d1dcb30c5c2c3b6db
SHA1 26277f93a6dcad1abfcabe3b5aee86a47085f141
SHA512 9352150f49f759285a23811c2b5f7c65a94db020f368d983a5a42d934db9f088eaaab490dc6e81ed3c5159bc8527c9251224715a0361293239e304559012662e
SSDEEP 3072:/mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Rm7Rkm1tYpBeh2BAoM
TLSH
T1CAC312275D75E83759B9BB1EB08E0B1F1EF14AA6C830DA91C8D85B0423FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 206eeec60028070fcc487f0b38960ce41b8999c19453e6b85a68b0ea51a6c3d4
MD5 a6710f2ef2660a8329bfe84e6280fd25
SHA1 0c463f7749e0abde868f6005c6f5630f39c1bf3e
SHA512 af389c39e8d69c4aa7aacd98a71b13c809da04fc15ddad89a79becfcb1b589fb8fb4e88e460914255240819cd8d23808d564a3f1908d967120b607acaacb082a
SSDEEP 3072:ClGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:Csm7Rkm1tYpBeh2BAoM
TLSH
T12CC3123B9D75A83759B9BB0EB08E0A1F1EF14AA7C930DE56C8D85B0423F97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download