25f3ce8b329826dfd76e1659cd941038df19681df19a5451afec134664c8798d

Analysis

user interaction
yes
max time kernel
177s
max time network
170s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
undetek-v10.37 (1).zip
Size 116KB
Sample260623-twabyses5k
SHA256 25f3ce8b329826dfd76e1659cd941038df19681df19a5451afec134664c8798d
MD5 6ec3aeff993d1bbdb2fa58993fe32a57
SHA1 8404a5ad22f99bc088f51f87fcc74c2aaa6924f5
SHA512 d041cd02dc6350bd1cca94c75387b33d0635b82f11b0cf4ec159f2657baf8b621317462b4b1e91da400cb152770832f6f7a4182bbf71bb743e0bdd3a99c085cd
SSDEEP 3072:d4MHCgbcbWJw7PSwq+LbRGk3v/S8jVTXrG3:dTRobWJqKD+3RGkycVT7u
TLSH
T167C3022024C0661579C238608787CDE32B92DBDFCBB62C09A067A4FAB767F5835741F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5992	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267054973039011"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-958335860-2021930596-4099878453-1000\{85BB1D6A-0DFF-49A2-9E21-C6DF36BDA692}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
6604	undetek-v10.37.exe
6604	undetek-v10.37.exe
4576	chrome.exe
4576	chrome.exe
1572	chrome.exe
1572	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe
Token: SeShutdownPrivilege	4576	chrome.exe
Token: SeCreatePagefilePrivilege	4576	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 5412	4576	chrome.exe	93
PID 4576 wrote to memory of 5992	4576	chrome.exe	94
PID 4576 wrote to memory of 784	4576	chrome.exe	95
PID 4576 wrote to memory of 784	4576	chrome.exe	95
PID 4576 wrote to memory of 3732	4576	chrome.exe	97
PID 4576 wrote to memory of 3732	4576	chrome.exe	97
PID 4576 wrote to memory of 6860	4576	chrome.exe	98
PID 4576 wrote to memory of 6860	4576	chrome.exe	98
PID 4576 wrote to memory of 7128	4576	chrome.exe	99
PID 4576 wrote to memory of 7128	4576	chrome.exe	99
PID 4576 wrote to memory of 1392	4576	chrome.exe	100
PID 4576 wrote to memory of 1392	4576	chrome.exe	100
PID 4576 wrote to memory of 5672	4576	chrome.exe	101
PID 4576 wrote to memory of 5672	4576	chrome.exe	101
PID 4576 wrote to memory of 5116	4576	chrome.exe	102
PID 4576 wrote to memory of 5116	4576	chrome.exe	102
PID 4576 wrote to memory of 4296	4576	chrome.exe	103
PID 4576 wrote to memory of 4296	4576	chrome.exe	103
PID 4576 wrote to memory of 7084	4576	chrome.exe	104
PID 4576 wrote to memory of 5228	4576	chrome.exe	105
PID 4576 wrote to memory of 5228	4576	chrome.exe	105
PID 4576 wrote to memory of 5620	4576	chrome.exe	106
PID 4576 wrote to memory of 5620	4576	chrome.exe	106
PID 4576 wrote to memory of 3772	4576	chrome.exe	108
PID 4576 wrote to memory of 3772	4576	chrome.exe	108
PID 4576 wrote to memory of 4484	4576	chrome.exe	111
PID 4576 wrote to memory of 4484	4576	chrome.exe	111
PID 4576 wrote to memory of 3660	4576	chrome.exe	112
PID 4576 wrote to memory of 3660	4576	chrome.exe	112
PID 4576 wrote to memory of 6764	4576	chrome.exe	113
PID 4576 wrote to memory of 4088	4576	chrome.exe	114
PID 4576 wrote to memory of 6764	4576	chrome.exe	113
PID 4576 wrote to memory of 4088	4576	chrome.exe	114
PID 4576 wrote to memory of 3104	4576	chrome.exe	115
PID 4576 wrote to memory of 3104	4576	chrome.exe	115
PID 4576 wrote to memory of 6700	4576	chrome.exe	116
PID 4576 wrote to memory of 6700	4576	chrome.exe	116
PID 4576 wrote to memory of 4740	4576	chrome.exe	117
PID 4576 wrote to memory of 4740	4576	chrome.exe	117
PID 4576 wrote to memory of 712	4576	chrome.exe	118
PID 4576 wrote to memory of 712	4576	chrome.exe	118
PID 4576 wrote to memory of 2420	4576	chrome.exe	119
PID 4576 wrote to memory of 2420	4576	chrome.exe	119
PID 4576 wrote to memory of 3700	4576	chrome.exe	120
PID 4576 wrote to memory of 3700	4576	chrome.exe	120
PID 4576 wrote to memory of 7024	4576	chrome.exe	121
PID 4576 wrote to memory of 7024	4576	chrome.exe	121
PID 4576 wrote to memory of 2060	4576	chrome.exe	122
PID 4576 wrote to memory of 2060	4576	chrome.exe	122
PID 4576 wrote to memory of 3412	4576	chrome.exe	123
PID 4576 wrote to memory of 3412	4576	chrome.exe	123
PID 4576 wrote to memory of 3828	4576	chrome.exe	124
PID 4576 wrote to memory of 3828	4576	chrome.exe	124
PID 4576 wrote to memory of 5884	4576	chrome.exe	125
PID 4576 wrote to memory of 5884	4576	chrome.exe	125
PID 4576 wrote to memory of 2984	4576	chrome.exe	126
PID 4576 wrote to memory of 1596	4576	chrome.exe	127
PID 4576 wrote to memory of 2984	4576	chrome.exe	126
PID 4576 wrote to memory of 1596	4576	chrome.exe	127
PID 4576 wrote to memory of 1268	4576	chrome.exe	128
PID 4576 wrote to memory of 1268	4576	chrome.exe	128
PID 4576 wrote to memory of 6912	4576	chrome.exe	129
PID 4576 wrote to memory of 6912	4576	chrome.exe	129
PID 4576 wrote to memory of 6656	4576	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\undetek-v10.37 (1).zip"
1⤵
PID:2424

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaa5c2c728,0x7ffaa5c2c734,0x7ffaa5c2c740
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1992,i,13126286649571423388,8255339438308124840,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,18105442031578838067,14102592685892036654,262144 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,4716213798747712534,13664166810153405017,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3352,i,4457053132270534418,11590084102561905973,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:6860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,10377523106515915824,949057189572649821,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:7128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4752,i,14612751263665528255,1121808553120766008,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,16439711452686130047,49144986240071679,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4976,i,4100573682470137452,4860191378865911881,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4944,i,4710110055881888105,9424807158072123825,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,5218269456802963301,11936623785109626449,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:7084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5500,i,7129023760153494451,740496129801161707,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5540,i,18044271821708261857,10743871605534139071,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5564,i,8706400811788877814,10331504986636687415,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5940,i,11844991346412007755,15304728958404626851,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5696,i,11642131945480398365,1070747163956648495,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6188,i,7379191754212049155,15230223247822974273,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:6764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6212,i,4601181514046785169,12470402537985276516,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5444,i,17220369509214353746,1989958411313641475,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4784,i,2243663111835965962,6374363535069380603,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:6700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3464,i,10381486272351658120,4032608370896154079,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3716,i,4803902534899805314,3466165581453803370,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5824,i,15514284985909476815,4078234354296941592,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4884,i,1568655498907244721,5332261471591415700,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5528,i,8736632262596598632,1194016718847262489,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:7024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6464,i,4800713864091593060,4729167862478917534,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,14349230643917509140,12770509975271366014,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3716,i,16316019541429864147,14625629789506414474,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,14474367631266900408,2131542349653725653,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6268,i,11932181574194880757,9722355308858108283,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5708,i,6903450821825887818,14554435238294401314,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:9
  2⤵
  PID:1596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=4748,i,6668048258246754581,1464569140418714990,2097152 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6928,i,16346771698338159306,17882748657953423959,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:12
  2⤵
  PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6456,i,1932509929846349504,10702807652562372950,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,15046539696621718521,8714942086855170045,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6440,i,15386786940231498885,8633200184873275094,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,16715115370777185154,14285145611811510284,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:14
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3756,i,15846513291524777422,938329830071276772,524288 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:6256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5748,i,13011837675731453380,9866199746154197659,262144 --field-trial-handle=2140,i,11975475922867911561,18393633839403150243,262144 --variations-seed-version --mojo-platform-channel-handle=896 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6960

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:2100

C:\Users\Admin\Desktop\undetek-v10.37\undetek-v10.37.exe
"C:\Users\Admin\Desktop\undetek-v10.37\undetek-v10.37.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:6604

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\undetek-v10.37\Install Guide.txt
1⤵
- Modifies registry class
PID:1948

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\undetek-v10.37\Aimbot Guide.txt
1⤵
- Modifies registry class
PID:1660

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\undetek-v10.37\VAC.txt
1⤵
- Modifies registry class
PID:6396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 16KB
SHA256 d1cb2a032c1bb6a96c22b5f16c6256db453f17c8bdfc40f0a97629848ea3b5db
MD5 19ab93d9b448ab4a9747389a1b5cc5a1
SHA1 4409552d0a5a1138e52cb54ecefa44dfff7328e1
SHA512 2d5512cb0691333bb30d54cf4115fc15e7fa899e1373650f7bd3d659771c5f3e152b3bdeb556de1015783064b6790da6f6c640cc8a9204793e1eef4a8ef814df
SSDEEP 384:WWuB124Y3oFuUKyTnPP8Yf/42Mwwwm2zq59a1z4na2Y5acpj3tRn5p:WWg24Y48Idn4jws2zq59uitsznD
TLSH
T16572C0448BC5FC192B6B827010B3FDAA0EAF62D1471904F98B88D70D788A269F2475E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 61dd3f6b5250b13895349e4135be1e4306b8b60172c02c0778f5141443dbe007
MD5 456dd379f5cfd816e01658ee00362f87
SHA1 fc6075f06de016210d0e939757d9f952076a8cf8
SHA512 487e414b3ef9f14fb17ece4445a3de1f64dd0071d27d734fac883730ac6ec903033cf795013a722e7a0034f0de9d4ffb4e5fd535e5c0aa8dc39653ff783cf710
TLSH
T1EA21CCC5A08D24D8EBA60FB700E64E2167317AF1D0452B0F40D4C9BAE8CB371D0A3CA4
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 c016454c9659ae7bc5cbb45b8bb86a6a29cfbb205d1a03d362396804bc33c5b3
MD5 f3b83529392ebbab8f42e7effb931831
SHA1 9febcfdbe436fd318f69908c2b78feda0096a867
SHA512 4f267a97a33160dde28e9cb80a6671191e2c4b4d5d9dbfcc077250331da822b0a30a373a3270e547e06688b09c3e8080bb890d06f7f4f0fb8b737ad49f824a86
SSDEEP 192:DzXXEcMJmV2KWFybei//fkYC88BVyNP7aP2XfPDVv5kAFNPsS6pTfAq5aTg4i5Jb:DzXXEcMJw2KWFybei//fkYC88BVyNzap
TLSH
T1BB32CDF7C3E8862DD85152F4AB152E2FCE690A24535C3DAAC8D5AF0B53E1872E24075F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0692e61e08d2ff3c3efe6c6872ed37c518de5c57a1f73d119c770bd10c55c782
MD5 53e15f57bb62310fdcbffe0e46f3dfbd
SHA1 5d3656924152a6da3bcaebea394ddc813f7d4f66
SHA512 6633e108c287fa5d8720f5a305e2ceeb69434dda177789fa1dc1f7fdd5b377858821c710e064f9afbacae4edd1c1c7d91650809bffd6ad9eaea4d2367d1139ec
SSDEEP 192:fRkcBz0gbq5VBv7GAPRp2MZh2P+yN9AHsb+WNT1Dg4Lo2rgejVyIsnAUge:fRkmz5bQVRDXuGwWr23e
TLSH
T1DE42B75EA924653B5DEBD25AFA21BB67D2F1203175D41EC0E6FC8A2C04E79CC3227427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8a302759dd12434a4d5a2467dcaf2312fdf09c31640e9d64490be6626ec94853
MD5 749a5ae486964dfdc312ca6b5c75b9e6
SHA1 6f73e7ad8a064ced5a740dff414193b8ef2f6cde
SHA512 252be9409f3fb58862a6a78ddc7018891e4e96b54f6fb61dfb47e7a9f3bc99f0bee356922d2416b1377104de911483ed386661897a13ca751ee98cbd97107633
SSDEEP 192:fRdcBz02bq5VHv7qtCPRpMpMZh2P+yk9AHsb+WNT1Dg4Lo2Lge4VyIsnAUgE:fRdmzVbQVPHX/GwWr2GE
TLSH
T15942C81FA924663B5DEBE25AFA11BB67D2F1203175D41EC4E6FC8A2C14E79CC2217023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 40e9d2fc2751758f6e890d6a60add76c31c009657fb3ce316b71c1b747882e9d
MD5 a29a0aa484067a7d135b238418796f12
SHA1 50b29fc78a1477d4c28be0bf2c05b1be20765ba6
SHA512 ff45161f92d0f9a174cb79728d8b94fed0cb34a818efe13c1afe7fe9ca2a791ccedaf70a45394bc91423a4974fc3df1a8474636d04b80eac8c1987838f08229d
SSDEEP 192:fRdcBz02bq5VHv7qAPRp2MZh2P+yk9AHsb+WNT1Dg4Lo27geGVyIsnAUgE:fRdmzVbQVPPXDGwWr2YE
TLSH
T10B42C86EA924653B5DEBE25AFA117B57E2F1203175D41EC0E6FC8A2C14E79CC3227413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 09de0ee3aec8e4f33314b2789b4baabdc6778b7a58fbe7ed3ea1b53de00920d1
MD5 13151882c3adf78cc7dddc1104f5eb01
SHA1 70f32d627bdb22cd2c790b8228f8dfb0dca15430
SHA512 f458d91cf51c8564dab04e128d025b3b0d3d4a857758f6fa4970710caa5dfc8f2f72d78a6b8b6ef935664512706671dfa427119e2e098be9ab52fb46dacda74d
SSDEEP 192:fRkcBz0gbq5VFv7GAPRp2MZh2P+yJ9AHsb+WNT1Dg4Lo2rgejVyIsnAUge:fRkmz5bQV1DXGGwWr23e
TLSH
T1FE42B75EA924653B5DEBD25AFA21BB67D2F1203175D41EC0E6FC8A2C04E79CC3227427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 984c0919cd6d1f459b9dbecaa43cd8079e182f787884c2f87a8303ed4d85260f
MD5 14e05489648b20bdb72883def04c2caf
SHA1 9c260f1668e2514bc8eeb32e4ab80682fe963f13
SHA512 3c7ca0548990e5bdae5381158364895aa8c7d4d7a5b2941d8b5aa6483c8dc6b65989b1d1abef411311e6b832f36c4264dadcbb879d716c3d9eed6b51d7fe94dc
SSDEEP 192:fRkcBz0gbq5VHv7qAPRp2MZh2P+yk9AHsb+WNT1Dg4Lo27geGVyIsnAUgE:fRkmz5bQVPPXDGwWr2YE
TLSH
T1B942C81EA924653B5DEBE25AFA117B57E2F1203175D41EC0E6FC8A2C14E79CC3217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 93da5b82c42ae365768bb99380392986bcd82cd500abcc9e58baa185f85b3012
MD5 356067b9ee4b878d1f5e3bddc02f5981
SHA1 17e52b31fbf70673e90532c025518b8c12adc74c
SHA512 2b8f7e71fcee3568de986da9029d3841b0e308360ae2c26771362488aae9248f2775b60ea0dd60f4a9968a1b4be3abf37c737d74fabc0b9264186e96784478eb
SSDEEP 192:eYX4K6FZ7KxkXqK4I40pUZNCgVLHrKHfFKslEx0DBXzKD/CR+ErUkKN93g6XfWk+:VXjKZ7KxkXqKf/pUZNCgVLH2HfgslcoB
TLSH
T10732C717948D9E3F4FDCE519DC526F4B6CB4029672680D2496FB9C0803A9BCE124A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 260e94c459b7a807ce11fd7fdbac76f66ce6227ab16189e4ad73a50283edf9d3
MD5 73e43f7bdda90d0fd1283b326f560eb6
SHA1 a2dc913f5207e08bd812d3f95d53dbae0e1bd896
SHA512 d08c7e037ed0164f91a61179be9a5389c5ec0a9a0ef4c66177e7fde64a0cf99ed29cb4e152719e9cc8f692562bcbb6015b13f5c177abf4d655725feb77ecc42a
TLSH
T11CA002A841D24846ED05137597C115F573118C904702C74340A04158CD6A2564107244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6ab1afc379c6a9b6fe631124964f969f0e3648495b1a92fbf97bd309dfaa1f78
MD5 8c6a78ccbeb088f487596a8e1b793d08
SHA1 42fdb77064e40d998611816c35f9d65eb4655afe
SHA512 0b6d16900c5d2441149f2d49bf36dd88ec359e9f5849cd2997d55f9cd9a965b376a72c8eaa798d5599f1b79a302a215352d3b223a1bfc56f891eafa4fa6f66fb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 67ff86de191f2437d3cc4f641a56942ff018778eee85fbc37ec40931c5150421
MD5 3117be7f21599747887f0f700b4124b5
SHA1 bb51743f441a8c3b57aa0458eb043b56cf2bb823
SHA512 d2a6e25ced7a8546294dc5cb5df43dcf4c4add5e4a85d5c49c2d06c3cbddf2ba12c27f6cc73bf6b56de7f4831b32c07f8b53df3eaaee82733c98e62899b4afcf
TLSH
T158A0029459C00815CD0246B07061158163514A64556147739692489D99EF5C45201A44
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 7e556ef74dc7a85e7b576048857c4408429225f2729fd43e01936d010c081ca9
MD5 2b758758b95b7c8d7bb2241a4532a6e7
SHA1 3425da69efff3bae4fcdd876f5f74b7af3b987bf
SHA512 a82cd1e63b7e25f523862295cddeffaf2bacb4a6fd6b3a2557a90c475bf8e1ce33048858f9fd45c372931f9668889e2d52c2681377bc1964724a7603bc1ec641
SSDEEP 3072:/kq/BnFfg+G20ImGXYCgymTVTWCS6kvuo5rfz9RtU6Y:/X/BFY+GemGoCqzBkvuoVfxRtU6Y
TLSH
T157C313B3D85C6D10A26A8DB070862E1F0FFC3AAE1D9192E4A3F84F6D56E854C57E1853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 34492cba9f9c5cfd7fb666c2ae6856c25295282061e37e54dbdbf0ab65a783df
MD5 e694e4b111f3b73209d4942609c2ad09
SHA1 965812572d1be7fa55e582a2dafa8069e1eb7361
SHA512 4850e17deb64f8484febdc2e06d6bff00474210ed9fb47fe27de465b5f8fdb1053be69e0e97197cf11336eb79cd955add3c09cfd2152f026b40e1b1b7122ea60
SSDEEP 3072:qkq/BnFfg+G20ImGXYCgymTVTWCS6kvuo5rfz9RtU6Y:qX/BFY+GemGoCqzBkvuoVfxRtU6Y
TLSH
T1AEC313B3D85C6D10A26A8DB070862E1F0FFC3AAE1D9192E4A3F84F6D46E814C57F1853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d195973bf10e23eea882bc7fb6421b84516cdcc3a4b8d4167d7da80d2bc6c8d4
MD5 da55225960939da8a0da3a7fd91b75c0
SHA1 19e12ec7b4261abf7e499cf86bc267efc221b232
SHA512 c23795c987463fa299a90b90fb2363c82839f4bd45db215a2edaa2ec23b5753e60507cb1df01b6ead6b2da3034cb488a05093c0677c40e1cf2ce17eddc34ef73
SSDEEP 96:pC6td+bAEDFsWftMAE1Y5PMRDotok5r9xDUmB6XdGyviwrXnXQFzbCsv4a:pCCEAysO41bDUDXU28werXXQtbl
TLSH
T1AEA12A31A87C8D6359B6E989B5166E038F74612BA6229FC8DAED5E0C10FB4FC1311927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 f6addfd13f8cef861c2c9e468cd18838901be1881a3d00ab12dadcb61a3c41b5
MD5 6c1432ee129e2692525fb6a0d0d71d39
SHA1 4bee8690917baed02be7dd6975ef08ee07511d89
SHA512 e2aa644eafcb2a88d2e1e7f753e65e62fdfa731c3fa39486d157338aebada12a1b60c2a1a827e3e5c2805a7db7e47a3f39b385c682f980601889f9cfe76f9f66
SSDEEP 3072:Eukq/BnFfg+G20ImGXYCgymTVTWCS6kvuo5rfz9RtU6Y:EuX/BFY+GemGoCqzBkvuoVfxRtU6Y
TLSH
T121C312B2981C5D1096668DB070423A1F0FFC7BAF5D9192D8B3F85E9C52ED14C8FE1892
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4576_1033884345\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download