hxxps://sethclydesdale[.]github[.]io/cunny-code/

Analysis

user interaction
yes
max time kernel
899s
max time network
887s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sethclydesdale.github.io/cunny-code/
Sample260729-nascravsdx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3996	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297971421057822"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
3028	chrome.exe
3028	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 2964	4324	chrome.exe	86
PID 4324 wrote to memory of 3820	4324	chrome.exe	87
PID 4324 wrote to memory of 3820	4324	chrome.exe	87
PID 4324 wrote to memory of 3996	4324	chrome.exe	88
PID 4324 wrote to memory of 4692	4324	chrome.exe	89
PID 4324 wrote to memory of 4692	4324	chrome.exe	89
PID 4324 wrote to memory of 4744	4324	chrome.exe	90
PID 4324 wrote to memory of 4696	4324	chrome.exe	91
PID 4324 wrote to memory of 4744	4324	chrome.exe	90
PID 4324 wrote to memory of 4696	4324	chrome.exe	91
PID 4324 wrote to memory of 4712	4324	chrome.exe	92
PID 4324 wrote to memory of 4712	4324	chrome.exe	92
PID 4324 wrote to memory of 4572	4324	chrome.exe	94
PID 4324 wrote to memory of 4572	4324	chrome.exe	94
PID 4324 wrote to memory of 1764	4324	chrome.exe	95
PID 4324 wrote to memory of 1764	4324	chrome.exe	95
PID 4324 wrote to memory of 2204	4324	chrome.exe	96
PID 4324 wrote to memory of 2204	4324	chrome.exe	96
PID 4324 wrote to memory of 3496	4324	chrome.exe	97
PID 4324 wrote to memory of 2796	4324	chrome.exe	112
PID 4324 wrote to memory of 3028	4324	chrome.exe	113
PID 4324 wrote to memory of 4976	4324	chrome.exe	114
PID 4324 wrote to memory of 3028	4324	chrome.exe	121
PID 4324 wrote to memory of 4776	4324	chrome.exe	127
PID 4324 wrote to memory of 4776	4324	chrome.exe	127

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sethclydesdale.github.io/cunny-code/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd9d81c728,0x7ffd9d81c734,0x7ffd9d81c740
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,17958426236105229076,10432092433528574123,262144 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1628,i,15816583043300475084,2588578287718476587,524288 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,13277056982718650750,2587201400286923679,524288 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,8822887175963278452,18095233768738716113,2097152 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,3662668700057039241,4803440693100760504,2097152 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,11171381542313082818,13955357205708133969,2097152 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,11473603337743012526,8523765636128815722,524288 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4900,i,17635041081318092746,14902037868577411960,2097152 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5080,i,18129525365745350940,6668278101253298717,2097152 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,18291784849858180875,7116246160356443300,524288 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,7705090812951816587,8602336064971327674,524288 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,7409837902250215623,3808219552723495782,524288 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,10646829821090934867,16749884116972908935,524288 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5964,i,15510667798284536781,4999742805137968347,262144 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,1236701968078184594,11918539699429246094,524288 --field-trial-handle=2008,i,2832809051563012703,3981084022893361323,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:4776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 95228e61a0ba26910a4d5fad2c29650c66ae712e35665dcdbc5e869a89b30be1
MD5 4d528e67af5ae49f7609da871192003a
SHA1 55c40a690f92d417199deec1b5269a8396881e79
SHA512 dbee63c066b46d8eabaf16c06a0e4e174a2365bb1d02f6351bf787ca5744b9b23464488b45ff0139e252718bc064bd2dc93316d518e46129a63821e37097b46a
TLSH
T134E02BA9C8219C270CFD1B2C65244646E74103167F90D84F7A3DD2088FB5E3B856786C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 6faaca15b7353653d2ee9d5a59d5e062201d4a3c220670e63a0b63c4bc05ecb3
MD5 bdabbd7a47eae9c601578a1fdc8ecc29
SHA1 92478471dd9d8aa0b94da9fbe2d01f64c45fb4b8
SHA512 75d353ea3c62daa5f3ca7f15465d241bad6810dc903ce8f285e8da57e4597bccdc501d6b35485f54e91748871d5d8f3c58165c1d12f826d64950886cdc3bded1
TLSH
T1E4F0926550D2A3DBCF13CA7B4DC52C3829719EE5066D17179044729DBB0FAEFB424302
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ace0bea06028db31ebf0f0b4d090f083363ec85d772da3bde6d055ebee76fa69
MD5 a38fec0e3b6c2ae1f2fd35bc4d87ee81
SHA1 13723f19a79cff796f82b4e9eef092f7c2dd0553
SHA512 9fbacf9c005499d98d1f528013ccfefd11df74f0ea7d2c458cc7429301cec8ddd0e8faa41a8bcc5727b13fb28175add6a9f411594eca16d51f04faf979a385fb
SSDEEP 192:DXJpgJeSJwJ4jaIaEdWwZF1Q3g6VLOzvzBPiMquPi+Pl3jhnPQfK:D5pseSJwJ4jaIaEdWwZFW3g6FOzvzBqs
TLSH
T13AD1DEFB9BE4856DCE024BF0BEA5EE17DD3A0825122C399544E4AE4B83E3871D241D4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 f32dab1144d8a4e8965612bc1ded284e081781831a5d5a812217a8dc39d413a4
MD5 6d9ea3abe255c057ee068ba21fdedcc3
SHA1 62d335eb26beaf1220a6025d24922857e8dd3fad
SHA512 2b9ca1905073bd13732df95f05d18aeb675d10ac96a2584c9d995c681de58e80f2a053bc305ada941d4c4d14513d937e31a7c23eda2bf096e9fc531d5a378904
SSDEEP 192:DBJWnJ7tJrJu0aIaEdWwZ/1Q3giVLOSvzBP2M6uPn+Pl3jhXnHH:DvWJ7tJrJu0aIaEdWwZ/W3giFOSvzBuF
TLSH
T194F1DFF78AD4856DCD024BF0BA65AE17DD3E0964122C3C5A84E4AF8F93E38B1D24194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 60e71baecef901b1d942ac8995c55dd74be2c8c6d63a821c628406212f5cdf23
MD5 337d00cdd7c44b132bfce46c271b6209
SHA1 8e807cc65e571ffffd285759c6dc33577652614d
SHA512 dd5455ad6aeabd5e928d2c03dccc576ab991c275a07472a55310d1a209afbe1dfe6e7e7004d25749a3decb1648874168bd60a09c036c05cf080f09450f794306
SSDEEP 192:DBJWnJ7tJrJGaIaEdWwZ/1Q3giVLOSvzBP2M6uPn+PqHH:DvWJ7tJrJGaIaEdWwZ/W3giFOSvzBuP6
TLSH
T1ECE1CDF78AD4856DCD024BF0BA65AE17DD2A0964522C3C5688E4AF8F93E38B1D24194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 c4faf7937c2fe5b7d177b57408310a2546bf31988c65bb2b853388ca786b3ed1
MD5 43afc97bf342ef27bf14b317fe07e438
SHA1 326f543f8b2dde6facf4ab3f6c252643c71a5b38
SHA512 8238c78d478d498ea60be902d7fc419c88b0e4123b10bf740d0ba7270dd65e360bf568ee3a0dddd336a51fcf1d13bcd1d68bcfaabb4b3a179e1b14414067030c
SSDEEP 192:DXJpgJeSJwJw0aIaEdWwZF1Q3g6VLOzvzBPiMquPi+Pl3jhXP9K:D5pseSJwJw0aIaEdWwZFW3g6FOzvzBqr
TLSH
T15DD1DFFB9BE4856DCE024BF0BEA5EE17DD3A0865122C399544E4AE4B83E3871D241D4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 d423a6e7a73ea39033de5d17fc5916c371fe4c6d2d964869adce827a8a73606a
MD5 fa6965ce64a63ffd52f61ef4a92a404d
SHA1 34a235f4d99e5573e30d59062a372ce8c4568a3c
SHA512 0e6cf1c69a151ec3316ad99e076660aa84763c7df46942a30d2ed59a491e23b72b5bf3c71dd8f860de44c2edf22c3867ce0f1b81ea9ebca0bf439e72e2590408
TLSH
T1C6116F97967EB417107D497B0D067C056576743103D279E4DF6A916CE0C25F32B16823
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d7826a011d321f6043251c77528e84573db9437fec895e60d7eba18e65d7b8d2
MD5 69cb97dbc08c9c99febe01f3f4f15a52
SHA1 09defa4a3def4b243b90684a0d7201e1d8f43102
SHA512 1ffbf488d49a8e025bd670967dcdc66a7a4a5470b9987f6fcc8fea49dea639a52ecc543bdb9c054e961a2e5031ce127471d99e3770d0fa740991bc278f723cb6
SSDEEP 192:4RljqC9hkCov7cpAPRp2qbl59BHsb+WNnDJ1Nx2uG2CnwkwXnaKyVyIsnAUge:4RljfX0wUXlbrw1F2l2v3aKye
TLSH
T1A142E92EAD1429BB5CDBD22AF9167753D3F9142265D02EC4EBFC8A2C14D76CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2cc022a5de9bea6c5bf49b9fbb306b44d1d10b236d5830c7ea285c77d658a15b
MD5 86a375952cf8dcf7403a450c01e23f7d
SHA1 4ae69ae6450f1584c53b046362a783bffcfbb2c9
SHA512 306c33cf1581ac639f37756b6d63a90b11df12ed4364bd3819500eee30295249e2e7a9a1771421a81954ae3a0ba0ba48bdbd2334e06bcc9e6f4d6e908c48b05f
SSDEEP 192:4RljlC9hkCCv7cpNPRpNqbl59BHsb+WNnDJ1qE1eHG2CnwkwXnaiy8yIsnAUgE:4RljgXOwXXgbrw1Nem2v3ai1E
TLSH
T17B52EA1FAC1429BB5CDAD629F9567B53D3F9142269D02EC4E7FC8A2C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9d5345ae86748ee0e9474499ed07941dee68da8f727f3eea250bb1776c923d42
MD5 87e2a9f1a9b0250b342e78d7037fcd6c
SHA1 82fe378a8de6a62a4d58d066f7add8186b09f421
SHA512 13809a6ebb0018629f697e0ec804624fafc2af10dd9a0a0491b645a54b0ad2dff6e2fcaccf45157546541501e5a4a809931af639a1aef6531c868a29c27697f3
SSDEEP 192:4RljqC9hkCiv7cpAPRp2qbl59BHsb+WNnDJ1qE1eZG2CnwkwXnaKy8yIsnAUge:4RljfXuwUXlbrw1Ne82v3aK1e
TLSH
T18642EA2EAD1428BB5CDAD22AF9567753E3F9142265D42EC0E7FC8A2C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 25072cca8aa7adbe59a39ea348ca171b9f1b99a7ba070d7597874fac4cc17f9f
MD5 51b90ae7b0cb433e7d5649aea2fb9ad4
SHA1 8656a88119deeb0044b0508e7602ed1cea0e839e
SHA512 154494c9565c4b5e72ef83bd276526a29dad671291fad6b70fdd2d8cf92b2b62cc7695c656ad634eddbb0c65115d7f77545205af9a975057aba634fb8955b6ff
SSDEEP 192:4RljqC9hkCCv7cpAPRp2qbl59BHsb+WNnDJ1qE1ehG2CnwkwXnaWy8yIsnAUgE:4RljfXOwUXlbrw1NeE2v3aW1E
TLSH
T11F42EA1FAD1429BB5DDAD22AF9167753E7F9142265D02EC0E7FC8A2C14E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 556960ea0c9454b33b323fd80adf05cd3efa9a62618a2202c3624ddee4000c14
MD5 15cd05f34a005b986d55796e4a24fb9c
SHA1 39068e4c9e928f22aa4b1b7d7b3f68e14cdae149
SHA512 e3cae194736fa8443a32e28f0e93950cc47e032843b51afa0ec66adfd57082362e0a20727e43da6d1574cfd7d19770f5c847721cb286f3fa5e4787f384503815
TLSH
T1FEB0124084415102C00342F8158228987168AF109A0A1B4143F07D36C8251908428250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5888a3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5888a3.TMP
Size 96B
SHA256 1fed8c8c2ab997e1b642d3f0e5995ce25bf9b022942696ad8ba2b513f914d0a1
MD5 cd2a3f552bdb831c4f98b6e05108fbb9
SHA1 a2d81ff1ed7c91579ae636d6b3c0a61f1556f27b
SHA512 e010bacdbdfa6f8ed04f8c6931121af65c9bc48486f85038f62c882cd1474fc7b9c2edbdb2abcef994c624207caca0f75b8970690f439f784cf092ec2ca8c0ac
TLSH
T151B00255C6037312D147C3B16A9AA5EC71A0DF75CA03621B93E82A6AFC26E605535560
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 3d35d0d9b534154e721e8dbdb0a34fd55c43241ccd6f90248ad39ecf9fbcc81f
MD5 af534447bd33ebe53f86c8fa80713d3d
SHA1 5589b7abbe3c60e342b8df6f3d289d61a24a74f2
SHA512 c3b178e9c8189bf702d9dece314e15ab05919c5841d84eacf970759dc74475689ac104a31d863d7d05958038e5a3c0ab96ba29e1cdc97d49a7f46b30136290ca
SSDEEP 3072:SfLlFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:mlFmUi21rSm8uUVNSlzY/
TLSH
T12DC31210B9A7B8F3FE8930447ADE2A154D6C0E818291C90196739D415DEF3C66FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3e366b5431b65d0079afc318f7529565bc1cf98d4e8e2ac4ec9cf350a432efbe
MD5 f71f0fe65a80d9531ea307c69e4f7efc
SHA1 a31ea12529d4f14b21d80d37609d8dcc3df18706
SHA512 f93c3428dd625372d6573cf38f6fbfccd05c08d13789b15f9da6fb2a7313b80add413471834c27e26c07bfdd9fa934a85ce4355884d394f652a6202292a1db67
SSDEEP 3072:SbLlFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:6lFmUi21rSm8uUVNSlzY/
TLSH
T158C31210B9A7B8F3EE8930447BDE2A154DAC0D818291C60196739D415DEF3C66FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a30397c8052c508f5d3bc66a344941c64b3c8f7e8a3bf041b4b1dd3ea14ae03a
MD5 f64a0ec569a6dbce83ec512dfb890453
SHA1 2c8d5a9aa7a139c9c3c9a293a3a0ba372b6e7101
SHA512 3603b3d33f1b95bb46b70fc5cd202087b6131b662857ec39c2a67819b135f3d30b90e2af0bdcc0fd032059560a539e554822a84c87041ab35e7a92cc1845ef40
SSDEEP 3072:SEFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:pFmUi21rSm8uUVNSlzY/
TLSH
T142C31300BAE3E8F2EE5930447BEE2A145D6C0D818291C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 db6a121134e8a6ceef5a7954d66bbf35ba5a3112f8ee7a956d99135257b4db74
MD5 1e3ea48c9e3cb8c9976aa02949eee8c4
SHA1 969b077f2be5cac843b958e8273b2387c7353a13
SHA512 49303e41955144c4e5767a8fd0aa54821c3ad00b3d384bafb5e476ab90274e056d303372e723868477e3e90430697a7617446702668f8fe45e362d991eada90e
SSDEEP 3072:SbqfFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:BFmUi21rSm8uUVNSlzY/
TLSH
T11AC3120079A7F8F3EE99304476EE2A159D680D818291C64157739E419DDF3C62FABB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download