5e2f8d8b0dffe84df5ecc1f387f57d0f799901b29e4ed8aa88edd788c2669d0c

Analysis

user interaction
yes
max time kernel
69s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordConfig.exe
Size 3.4MB
Sample260803-qwwcmszfrc
SHA256 5e2f8d8b0dffe84df5ecc1f387f57d0f799901b29e4ed8aa88edd788c2669d0c
MD5 7b1964b18226b382359a87213a743f46
SHA1 1669c3cf1a47bcac7baa412e8f7091f961e4f01f
SHA512 0653418e25b417fb2da52e14e7c3609d18d9f01710c7e6e851c164205d294955f633b314fda2bad8a23e83fd5160aba4c7c2f5ba06985c1219622527d11f31b6
SSDEEP 98304:/ZKAVVrgikfXE3gPrjGQdqrduFoQ7Um174iiWcL9kHfDD:/DrgikGgPrjGQdqduUm1LiWyaX
TLSH
T138F533356261B350C920DF357DABB7F38FB30F25A57AB28E57183B6719B365B4000A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
34	4288	chrome.exe
96	4288	chrome.exe

Loads dropped DLL 4 IoCs

pid	Process
3304	DiscordConfig.exe
3304	DiscordConfig.exe
3304	DiscordConfig.exe
3304	DiscordConfig.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
8972	powershell.exe
6204	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3064	cmd.exe
4176	cmd.exe
9128	cmd.exe
4232	cmd.exe
5596	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordConfig.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4288	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302378621138956"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
8560	reg.exe
9176	reg.exe
5544	reg.exe
6196	reg.exe
6696	reg.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3304	DiscordConfig.exe
3304	DiscordConfig.exe
3304	DiscordConfig.exe
3304	DiscordConfig.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4544	1540	chrome.exe	90
PID 1540 wrote to memory of 2512	1540	chrome.exe	91
PID 1540 wrote to memory of 2512	1540	chrome.exe	91
PID 1540 wrote to memory of 4288	1540	chrome.exe	92
PID 1540 wrote to memory of 1904	1540	chrome.exe	94
PID 1540 wrote to memory of 1904	1540	chrome.exe	94
PID 1540 wrote to memory of 6036	1540	chrome.exe	95
PID 1540 wrote to memory of 6036	1540	chrome.exe	95
PID 1540 wrote to memory of 3300	1540	chrome.exe	96
PID 1540 wrote to memory of 3300	1540	chrome.exe	96
PID 1540 wrote to memory of 700	1540	chrome.exe	97
PID 1540 wrote to memory of 700	1540	chrome.exe	97
PID 1540 wrote to memory of 3020	1540	chrome.exe	98
PID 1540 wrote to memory of 3020	1540	chrome.exe	98
PID 1540 wrote to memory of 2760	1540	chrome.exe	99
PID 1540 wrote to memory of 4712	1540	chrome.exe	101
PID 1540 wrote to memory of 4712	1540	chrome.exe	101
PID 1540 wrote to memory of 5836	1540	chrome.exe	102
PID 1540 wrote to memory of 5836	1540	chrome.exe	102
PID 1540 wrote to memory of 4456	1540	chrome.exe	105
PID 1540 wrote to memory of 4008	1540	chrome.exe	106
PID 1540 wrote to memory of 5872	1540	chrome.exe	107
PID 1540 wrote to memory of 4300	1540	chrome.exe	108
PID 1540 wrote to memory of 4456	1540	chrome.exe	105
PID 1540 wrote to memory of 4008	1540	chrome.exe	106
PID 1540 wrote to memory of 5872	1540	chrome.exe	107
PID 1540 wrote to memory of 4300	1540	chrome.exe	108
PID 1540 wrote to memory of 3172	1540	chrome.exe	109
PID 1540 wrote to memory of 3172	1540	chrome.exe	109
PID 1540 wrote to memory of 4976	1540	chrome.exe	110
PID 1540 wrote to memory of 4976	1540	chrome.exe	110
PID 1540 wrote to memory of 5088	1540	chrome.exe	111
PID 1540 wrote to memory of 6048	1540	chrome.exe	112
PID 1540 wrote to memory of 5088	1540	chrome.exe	111
PID 1540 wrote to memory of 6048	1540	chrome.exe	112
PID 1540 wrote to memory of 1356	1540	chrome.exe	114
PID 1540 wrote to memory of 1356	1540	chrome.exe	114
PID 1540 wrote to memory of 5812	1540	chrome.exe	115
PID 1540 wrote to memory of 5812	1540	chrome.exe	115
PID 1540 wrote to memory of 4684	1540	chrome.exe	117
PID 1540 wrote to memory of 3012	1540	chrome.exe	118
PID 1540 wrote to memory of 3060	1540	chrome.exe	119
PID 1540 wrote to memory of 4564	1540	chrome.exe	127
PID 1540 wrote to memory of 3012	1540	chrome.exe	118
PID 1540 wrote to memory of 2964	1540	chrome.exe	121
PID 1540 wrote to memory of 2964	1540	chrome.exe	121
PID 1540 wrote to memory of 108	1540	chrome.exe	122
PID 1540 wrote to memory of 264	1540	chrome.exe	123
PID 1540 wrote to memory of 108	1540	chrome.exe	122
PID 1540 wrote to memory of 264	1540	chrome.exe	123
PID 1540 wrote to memory of 2356	1540	chrome.exe	124
PID 1540 wrote to memory of 2356	1540	chrome.exe	124
PID 1540 wrote to memory of 4588	1540	chrome.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\DiscordConfig.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordConfig.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd97dcc728,0x7ffd97dcc734,0x7ffd97dcc740
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,3777736326339163298,15152806218748100481,262144 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2196,i,6931018158757161086,16027284470938181757,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,3147451642572963083,15174831456505787333,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3328,i,12393349357433961209,13968637162187815604,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,4412029352818449021,12685062122857331098,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4668,i,275858086189429662,2918200986201754401,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,14778128335563517638,8087606144799618413,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5100,i,15443341117820870595,1539531945642092836,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5492,i,17338332091673349330,16695182594408620520,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5532,i,3732000471536674529,6784987183936637267,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5692,i,6961077473255214432,10107216837154708634,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5836,i,6235899315963539367,912557752965542761,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6016,i,8593652090912630051,14904277221303372357,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,16924794448538208438,8249328468331781538,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5564,i,9020154753599994163,9635870795798451116,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4672,i,2049852301696927849,8580308512708994968,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6396,i,18207866479643056142,8854359564692194405,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6752,i,16602850697896090503,3303263074988265286,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5784,i,18441400154082611520,5450116504682251013,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6744,i,14312818384938186838,13734226527827328823,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6628,i,7048361933633217910,16372283247226785783,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6720,i,6831593321340979971,12885857105599804671,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,10297751205421604377,2094240612044669349,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,8044779986069416616,18437544039788404618,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
  2⤵
  PID:4564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6980,i,15659595742709411387,4791816681444111908,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6676,i,12065957892902009845,1435847686947781325,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3592,i,11057199613697319682,7775976566614671226,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:9
  2⤵
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4892,i,12100437528641091830,6735624746380915441,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6944,i,2996226236553910227,7502482362353524537,524288 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:4588
- C:\Users\Admin\Downloads\MedalSetup.NzI1NDY0MjE0LDEsbm9yZWY= (1).exe
  "C:\Users\Admin\Downloads\MedalSetup.NzI1NDY0MjE0LDEsbm9yZWY= (1).exe"
  2⤵
  PID:3148
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
    3⤵
    PID:5064
  - - C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\Squirrel.exe
      "C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      4⤵
      PID:9184
  - - C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\Medal.exe
      "C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\Medal.exe" --squirrel-install 2631.357.1
      4⤵
      PID:6148
    - - C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\Medal.exe
        
        C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\Medal.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Medal /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Medal\Crashpad --url=https://sentry.medal.tv/api/1378175/minidump/?sentry_key=c8a362b2878242408b487aafa89be8a7 "--annotation=_companyName=Medal B.V." --annotation=_productName=Medal --annotation=_version=2631.357.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=40.1.0 --initial-client-data=0x484,0x48c,0x490,0x460,0x494,0x7ff7a6ba76b4,0x7ff7a6ba76c0,0x7ff7a6ba76d0
        5⤵
        
        PID:5020
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -c "Get-CimInstance -ClassName Win32_VideoController | Format-List -Property Name, Description, Caption, AdapterRAM"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query HKCU\Software\Medal /v UUID"
        5⤵
        Executes a command shell one-liner
        
        PID:5596
      - C:\Windows\system32\reg.exe
        
        reg query HKCU\Software\Medal /v UUID
        6⤵
        Modifies registry key
        
        PID:6196
    - - C:\Windows\system32\fsutil.exe
        
        fsutil dirty query C:
        5⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Medal\Update.exe
        
        C:\Users\Admin\AppData\Local\Medal\Update.exe --createShortcut=Medal.exe
        5⤵
        
        PID:1512
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"
        5⤵
        Executes a command shell one-liner
        
        PID:3064
      - C:\Windows\system32\reg.exe
        
        reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid
        6⤵
        Modifies registry key
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\Medal.exe
        
        "C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\Medal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2256,i,11371409758818932412,13006201189345900075,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2296 /prefetch:11
        5⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\Medal.exe
        
        "C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\Medal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2256,i,11371409758818932412,13006201189345900075,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2252 /prefetch:2
        5⤵
        
        PID:7308
- C:\Users\Admin\Downloads\MedalSetup.NzI1NDY0MjE0LDEsbm9yZWY= (1).exe
  "C:\Users\Admin\Downloads\MedalSetup.NzI1NDY0MjE0LDEsbm9yZWY= (1).exe"
  2⤵
  PID:4564
- - C:\ProgramData\Admin\SquirrelTemp\Update.exe
    "C:\ProgramData\Admin\SquirrelTemp\Update.exe" --install .
    3⤵
    PID:2168
  - - C:\ProgramData\Admin\Medal\app-2631.357.1\Squirrel.exe
      "C:\ProgramData\Admin\Medal\app-2631.357.1\Squirrel.exe" --updateSelf=C:\ProgramData\Admin\SquirrelTemp\Update.exe
      4⤵
      PID:8720
  - - C:\ProgramData\Admin\Medal\app-2631.357.1\Medal.exe
      "C:\ProgramData\Admin\Medal\app-2631.357.1\Medal.exe" --squirrel-install 2631.357.1
      4⤵
      PID:7620
    - - C:\ProgramData\Admin\Medal\app-2631.357.1\Medal.exe
        
        C:\ProgramData\Admin\Medal\app-2631.357.1\Medal.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Medal /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Medal\Crashpad --url=https://sentry.medal.tv/api/1378175/minidump/?sentry_key=c8a362b2878242408b487aafa89be8a7 "--annotation=_companyName=Medal B.V." --annotation=_productName=Medal --annotation=_version=2631.357.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=40.1.0 --initial-client-data=0x490,0x494,0x498,0x488,0x49c,0x7ff6ca3c76b4,0x7ff6ca3c76c0,0x7ff6ca3c76d0
        5⤵
        
        PID:8872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -c "Get-CimInstance -ClassName Win32_VideoController | Format-List -Property Name, Description, Caption, AdapterRAM"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8972
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query HKCU\Software\Medal /v UUID"
        5⤵
        Executes a command shell one-liner
        
        PID:4176
      - C:\Windows\system32\reg.exe
        
        reg query HKCU\Software\Medal /v UUID
        6⤵
        Modifies registry key
        
        PID:8560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg add HKCU\Software\Medal /v UUID /t REG_SZ /d 54140686-66a7-47b0-982d-05a8a4238b4a /f"
        5⤵
        Executes a command shell one-liner
        
        PID:9128
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Medal /v UUID /t REG_SZ /d 54140686-66a7-47b0-982d-05a8a4238b4a /f
        6⤵
        Modifies registry key
        
        PID:9176
    - - C:\Windows\system32\fsutil.exe
        
        fsutil dirty query C:
        5⤵
        
        PID:2176
    - - C:\ProgramData\Admin\Medal\Update.exe
        
        C:\ProgramData\Admin\Medal\Update.exe --createShortcut=Medal.exe
        5⤵
        
        PID:1872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"
        5⤵
        Executes a command shell one-liner
        
        PID:4232
      - C:\Windows\system32\reg.exe
        
        reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid
        6⤵
        Modifies registry key
        
        PID:5544
    - - C:\ProgramData\Admin\Medal\app-2631.357.1\Medal.exe
        
        "C:\ProgramData\Admin\Medal\app-2631.357.1\Medal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2004,i,14527570784789616523,731685568269628206,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2000 /prefetch:2
        5⤵
        
        PID:6160
    - - C:\ProgramData\Admin\Medal\app-2631.357.1\Medal.exe
        
        "C:\ProgramData\Admin\Medal\app-2631.357.1\Medal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2004,i,14527570784789616523,731685568269628206,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2268 /prefetch:11
        5⤵
        
        PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6944,i,14841337591583337776,14515900132549906798,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6956,i,3038737638587700997,116579636194528796,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:7080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=4764,i,4359912618445449688,2454097175634393745,2097152 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:6904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6996,i,8796566277482832036,9313529593284799594,262144 --field-trial-handle=1840,i,18080195509430791174,5318224700026279752,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:10
  2⤵
  PID:2016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

icudtl.dat

Path C:\ProgramData\Admin\Medal\app-2631.357.1\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\index.js
Size 984B
SHA256 7fe5245bc82f099828bfecf7f78e4c417d6a20fc97ccbf30ac17bff7396aeec9
MD5 ed1be6152752554b6a465aa75913a099
SHA1 b6b0a55907a09ea1772c7dddb9fa912e12f52f87
SHA512 f8b1ee59576fac44095deef9bd3d5c5a1b5901c2453d0378b96a40f77f52ae666585847af85888d8a8e2cd2a09745c16c28098b3f5c415f86a906ae275848e66
TLSH
T1EC1154C5A5FF6551AAB183AD302B02B9FA36832226A32361B86C97072F55650631383E
MD5 SHA1 SHA512 TLSH

Submit Download

main.min.js

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\main.min.js
Size 4.7MB
SHA256 ba7b3afce8c4b9bf270d50007865dd5b23f17a8e7ade413e7921fe45fcc8ffe5
MD5 d4e15387da9e1789dc2ddc439ca764f8
SHA1 6a5f36d766ca2cc25f880cc8092a7bf3e64e4e1c
SHA512 fc379301316a0e77ba258fec930d28cb3e0957b53659efc1b1cabc9bca8a3bf3442f4eb69029463a48085f24b0f8b30942021afd5581ee11c7bc7343159b263e
SSDEEP 49152:ghNErrL+nZQsyJSyRXOhzi7wEkWArPkrF5E+G4gpKF9invR/X8evrAe7igpOfTTe:MUL+nZ+SRhziPArPkZp6JV00XMAeSGI
TLSH
T18E366ED976E334224BA361B9991B5002B3349407740CC858FA9CCEEA2FD585D96B7FBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\node_modules\ws\index.js
Size 796B
SHA256 924564d5be26d59b9682c4263f68320e48dde7240bd2d1ad17ec305537429dd2
MD5 a15f5d41d74ff8472614c54d87841f64
SHA1 519557fda97020cb2a4c7aeffe7f8edf03e536d2
SHA512 89d799e4281f6906c46b1105b50bb0baf9d9b09adeaace3b48f8a4071f951350cda2ac56f8c47fef5fcdbc1a1d5a1ca139f7c10c547c066f533aef5e5968e0c9
TLSH
T1B9017590D5B5A5D930F852D1F96CF0C1B7978148FB0695C1A67CC7E3648B08C5B19FD2
MD5 SHA1 SHA512 TLSH

Submit Download

buffer-util.js

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\node_modules\ws\lib\buffer-util.js
Size 2KB
SHA256 8b0a45739132f82e25ea13163780abf547ccfe989267f3eb7abb475beec92da3
MD5 8c25c9dd9f6e3773f89b9e32b7105c3d
SHA1 f7118209aa3e4032abdb8180519a3cad15f0de05
SHA512 bc2e6d02069d7841150e43cbfafc5992e3003906363ff38dbb2ad9c8d39af99fa47e1343ababad1f72d27e3e09e022b9cafa978a57539ab3da27eda4168596de
TLSH
T1D651144A2FE060760203F26711C75E8FA3748A05B657D945511D6F602FECA74DDF1ED8
MD5 SHA1 SHA512 TLSH

Submit Download

constants.js

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\node_modules\ws\lib\constants.js
Size 503B
SHA256 391e823142b8b370e55a2fd32b022deaf03b8415c56000009674ebc86a0b4f86
MD5 22783d577f2ad3dfbad775128bcfad96
SHA1 b3726aae205316457c35cbbbc75b8dc73562e08b
SHA512 2103cfdaa7625d5a094426d0cfcce965f053a2934888db120a800c31322bdd5634f1988d66208c5431703fda6226954bc264fa5dddfc45cc81f5ce1ac2643b22
TLSH
T161F0592F1FD0B2BD9CB7500F5A6EBE45B8D15CA223CFF91550489EA8470C8401579684
MD5 SHA1 SHA512 TLSH

Submit Download

limiter.js

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\node_modules\ws\lib\limiter.js
Size 1KB
SHA256 e0469d4b83f6ba764b15f80e1766b75c136fbff68f048f4c050f0b1c7f065f69
MD5 7b8a8dc5be27a1bd1a39544cc28ae73e
SHA1 d56ca70e1a496b15e1cc90ac740679d7a6c37eab
SHA512 1c1731373a93c3d7f27dde4b6e06565d013ec7fdf6714ec3e1f5844752059a0790e4bc571f20301f45dc63a55e9129e304ecf3551791370c40152942caecd574
TLSH
T16111CE2606EE14E2D02321B58E6B6254E562110FB61FE8D97A3D13AC4F46F30E294D79
MD5 SHA1 SHA512 TLSH

Submit Download

permessage-deflate.js

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\node_modules\ws\lib\permessage-deflate.js
Size 14KB
SHA256 02c31796f0132a335d4efe7b7adcebadbb69543a1ce65ae04aaccc3530e27ab9
MD5 607070f8184092407c7a63fac8c69f20
SHA1 9f9896dc0a4352671647ce41168fd790feea669e
SHA512 f9b361c89d6b73e72e3eeb4ff7ffdae3e98c9f3946d8c9af37b1a94812ec4fc3057e8bead1886d2532b38ad119eec6bff5a4075d2a7874a829a7e3ed09fe924e
SSDEEP 384:CxmZikcIjmNBu/OMiSOsbOk7OadYO7oFJt8:oiiDIaLZSOIOmOxOb
TLSH
T1266261591BFA026740E767E68FABA24AD330D01B352AD588395C53CE1FCDE34D399B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream.js

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\node_modules\ws\lib\stream.js
Size 4KB
SHA256 a56fcb6e2b152097ee820b6f5410b1f71e59819b45d08d9f8bda588fe39070ec
MD5 06840a6e365bdb23c05dd958e4756473
SHA1 d3de11ef622c66ffc0ea4c2bdc114e85779d0db6
SHA512 89d9ef4ea0cc3ff80d7697229c2ef9a6c57d2308f3e0469cd94a1dbd2da2e0de1968839773f23c986efa6f91ec1ac3a960226f0427d9c0e0846b31ea6f0b2ee2
SSDEEP 96:/QWVMjxumJYNQ6gvRNYY/LDg5Ib0IxC6tIqO:oWVMNwgvb5zsqbk66qO
TLSH
T183812F4DE2BB126B6577B5ED4BDF83E53250C453112EEA40B58CCBA42F1E4340674EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

websocket.js

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\node_modules\ws\lib\websocket.js
Size 36KB
SHA256 48fdb0f54c1f8ce580d3cfa2908fe7d96fe18f06f9d82306950441cb09b5db26
MD5 a3d873bc91b588b5ce78505549794716
SHA1 853865477225df4201343d9cf1c4583eaf8d228f
SHA512 1b1e83ccb53641b689ad38b45863733f386ce27d218d0a03ec72dd4ff498756537ef141636ec4327b9076962c7409a6f95fde5043fb645df45a2b94c9aa7239f
SSDEEP 768:774+FgTtkckOy1chyT+220GXNsdjg6N2GwGgiEOqkT8YwZkNercXd:7gTkT+220GXNsdjgCgZOqkT8YwO3
TLSH
T1F8F2A785EDFA13AA60B6E2B54B8F6485F330801B7316D5D8345CDBE86F4FA7042A5BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\node_modules\ws\package.json
Size 1KB
SHA256 584ce6e7516587ba249dc910b0c04e2753f6b3f451fc3a5bc324f7735bdacc71
MD5 fb5c34c5e2edffc3f31f4465740590aa
SHA1 98891dbb3b44c5734c567b72eba63c094e50117a
SHA512 314eab3555cc397a2ade5b627a38a4e99b9200b060fefeb7fb007fbc248efd836e682f9c4d65423d4c0835d323b5a31ffbf486b18257518e578bc2549ce1f85f
TLSH
T1C031FE76CC790EE30EE529A878A441527232485B5984FC0C7BD7431C4F4EAAF11FEA5D
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\package.json
Size 9KB
SHA256 c002e7a8b35781ef8aab0f789a44b7eb475fa452b0046198856da56c3d8d4eb5
MD5 78737d10c4ab23d68006e7106abede53
SHA1 4ee3b0875b7e4345fbdf833a104def609b145e0d
SHA512 271345f6a7b35064b7da49f6adf1aca02b9e0e2e5bce61da9e291d1c230c2b7030a44b9067c0c0f63eeff1b4a15b0113efc6daa916a6b7a7a37e745b49f20595
SSDEEP 192:FmTp5cJXN/ryosGosWOYTY/SkULnON5d/PFn6dvsKa9N2YvEYtAF1xgaJr:G+JNGosGosWOAn0dHF6dkKa9/vE8Q
TLSH
T17912307BCD488DB30DB2051ABAB82569F02E530F929DC6CF3774436E0FB3A2A4559791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Inter.ttf

Path C:\ProgramData\Admin\Medal\app-2631.357.1\resources\app\src\assets\overlay\Inter.ttf
Size 854KB
SHA256 0be2399ea925f1f83ff974764761da9860ec50742ed29a5d4c1ffd0c5c7ac3a8
MD5 0a77e23a8fdbe6caefd53cb04c26fabc
SHA1 ee5c2e22ffeddefc433c9aa4c76779bb73a5c682
SHA512 6012de93c8523799869b8976f620936651efc0395c66f1a6a56d417288c1b05675662c5c740800ea935eaae1968f2befe279d0264eb0805f6b98e5ab042a9316
SSDEEP 24576:Wap5PFuuuuPz2iKeRpJ6iruEOwRy+4FFNea:WapTL2iKeRpJ6iar9F7
TLSH
T1F7158E53F282CF5EC2592B358A734B9462396870FF17130F696573B4AEA33E0694D6E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\ProgramData\Admin\Medal\app-2631.357.1\squirrel.exe
Size 2.0MB
SHA256 9c9c39c36c3007491d19cfeb7ed3429d68e0a54a7cee919bbdc503471f89421b
MD5 4ecdc3370223e94f293e40e2bb801c2e
SHA1 a0799d388a33a6e167ddbf11bfbc4699fbb4854b
SHA512 4b955a3303e1b195cdd2e3a6bd79284029de12014a044ce13b11330177bcbf76cc6aa75f188f5cc29cb868ab889a56d962ffbf12b747f17bc9c85dbc5d02b158
SSDEEP 49152:wKf4kxKNMVup88THrE/HF3wfGHxF5v9+bp:ziTHrE/HF3wfoQ1
TLSH
T12EA55A01A7E88E3BD56E17B6A470269807F3DE973721F38B660971B92EB37109D02357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\ProgramData\Admin\Medal\app-2631.357.1\v8_context_snapshot.bin
Size 696KB
SHA256 1df86ae706c6fc60bb6f4e60d76c5a3f56affa54e6b1442f51127bedc589d089
MD5 ac1ecab348d666e70d3bfe6877a43f99
SHA1 7e22faa7dd16b965c4af9e6b85b12a11d2060f19
SHA512 81bc684328821627718339eca626130380dad46c9c024df775d5356ca20a5fa9cc55b48f8e9d7ea244f065c86977c952a14c7dce29963f1c5afe1285bdf76d08
SSDEEP 6144:9af8tLrT5X3ukt+H92AqD9clxP2NyhaigNw69I3ndbkboE/UZ703yCTzrWD:9af8tL35X3usCN2NyI4NbkboE1rTzm
TLSH
T197E49761F71ACF26C6493A7D8DD657463930B2CE8E46E24B3406B33E78B96704D3662C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\ProgramData\Admin\SquirrelTemp\RELEASES
Size 81B
SHA256 3d579c0131505e589ebaf64950f11b8ee18fa2e2754174f2a74d42fecc004309
MD5 445ea6bff653794f37be0d570b029a93
SHA1 c50e2b8aa4a753c42ab700cb00eb81eceddb5549
SHA512 12dcbbc550a8064c69c6c4cdba60824a96465e81d5c3cb8be28bb036170ecb53f79ba5e0f24bce9ae134d9993e87c7c2cabca6e24b19c9848f342bebb8aad183
TLSH
T120A0124C1C49007488C79000104481190422D1C55AC532DC0A155303092C180956155C
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\ProgramData\Admin\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 f227fb387354c36743d9bd9b64fecd7cea6cb26dca9e5090f0652187bfbc933c
MD5 c5fc191e938a531d5fbec1ca6ced97a8
SHA1 7583102ba521149b4468f304d4c218eb3d8c34d5
SHA512 f12c9b452998f80394283aa061062caf5bf4863ea60058dbf962f8164e9de9429c313ec44ab2d53fe6aa697614fe7568dbfa2ee0fd29e71bfb31ba5368d1dede
SSDEEP 24576:jKBgsOuZ27kxKNMVup8gZTHfTE/HF3wryXg6UDfbXuj4Gx/TbBxaMt5vedX5KZ+6:jKf4kxKNMVup88THrE/HF3wfGHxF5v9v
TLSH
T12A956A12A7E88F2FE56E27B6F070105907F3E5866372F78B660CA5B92E833644D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\ProgramData\Admin\SquirrelTemp\setupIcon.ico
Size 210KB
SHA256 b224df52e505c1f0ea3f7a3257e9bebfcc2bc6970ab69cd9feab3af43c1dab33
MD5 3568c98fce9ef20d3f794eadb7f5fdad
SHA1 3b6fc8ad3e1c7f437f347d3da697164f9b99fad8
SHA512 45198e0f81eb07adb96b2032ac0b137addbf0f07db2655cdc33f8ee907c9a0a60f8891265f967a40ffa2c8b0f6b3f8248af1997f1728610602d942e6f0b43e13
SSDEEP 3072:OX8S3N7VqAD3iP4i5obSRQ8+IN9NPynLDSL81rgIJtuYSAECNxQ/f:ZS3N5qADSQi5o+RQ3qL8dRtuog
TLSH
T1F524D09C26625477C6A40EF59BB0BFD8423A4FE33F09218471433566BD7EB07EA5B086
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 809e50b287116a1f1081abfec0e3d6987b4e02c58f2343c72df6a9fe15982edc
MD5 3eaddf5f46892ac5f773f499facd381c
SHA1 d85cf8444a449914fc2c0d45e49cfcc597192e4a
SHA512 78193ee208a82f44dd23bd8e671be722f5ff0f9056ab3b0f31eb2f67ac502411339b755d33f0609f2735e5a2910c6229ea61964867ae7d635908e7ca52a1791e
TLSH
T1B4F028B5C935EC3719FD1B6830A80B47E75013572B81886F3A3D920C8FB063B858A81C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 192KB
SHA256 a4f1c384afebe95e722f6a5dfedc9a3948a66d3d024c93e414a277e6debea2fe
MD5 29cd94b4bbb64a91ca227356d4ee071d
SHA1 8e218335961e407f7265ec9637c350ba22c54096
SHA512 0cb714a97f34ca0c3605afb20e93ce9ce9d15fe8305a1771133830f43e725a21bcfac7891e55816336ccd263bf84d99b978fc4d2e1b496dd8437e5d531069e74
SSDEEP 3072:zCaVjsVczSKDwklGUksESU4n3ffHYbeqcH8LZYRAzI7pIW4A+tFqD2r5BqVC0i7:zCem4/BksESUC3HkGOZK7B4K2r5AVj6
TLSH
T1F91423D71EA8C8C759C221F5FD4683D2DCC2B0C5967BF2841C9EF27998243BA55B0B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 10fb6ea32847b6b31a969c0f02ce6cc9096293011e0c7cc28645396814f9e3c0
MD5 e659b7c6868e0ffdcc9cdf91d5b0a8ef
SHA1 910df39533b5ff092c907e85ba2b90c2c8034775
SHA512 3ee329994964e1a0d052b3a523cffc1a469a79536c5c416170d231693a4c7a8c8fed6f62b84b8e42131c808f8b278ed25822fd481f0c91628fa0891fd55fbb81
TLSH
T17A4186F0A2D2B600CF9A823913DC4CBB35F88B8910C70FC7A15465715E9FBAB14416C5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9f16162f60e8973dd6d6900d5108002d836405924c654148d42c3f92a583695c
MD5 3dc08134c9ca3139f3d9073b3fe62abe
SHA1 d5d0cf50e23580f14d4f1e558f99f1e0d82a5aed
SHA512 39e965401192eb05e850f58c1813148f993c0c12a2f55c861dd8f8b8a03cec667203f8cfe0f86c66eb309161ab172e61d760753426cb80f24937287824cc32b6
TLSH
T16B5197F0A3D2B200CF9A823953DC4CBB35F88B8A50C70FC7616865716E9FBAB14426C5
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 6e817b7a15fbd525128e71c5730d3921cd7c78a0fd9de6d08a5e16d986127d9f
MD5 df49f35de08c99c46977825dd64bb482
SHA1 6bfc05cc0ba06687208642ee0c0e70b80ce44d2a
SHA512 4f419e11f41756bca14c4b9a9672eb7dd5571b4784bee7101fa2b4bc47544eee01c57831f4e5a4f3ef25173ea230de0b9ebb9110d47968f84c8fc89b2218c546
SSDEEP 384:DUA8LM6NcNx4ieoqVIt/Lbf9+PY7YmMPi1BJeYYoLUIeyI/IggyxeVbNu+B+owTE:onwTgF/unJ
TLSH
T1CF52AAFBD3E4C66EC95252F1EA142E2BCE1A1527431C7C1AC5D49E0B93E2870F251A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1fa2d2d2b412562d936ee032e6d63990d87e2bfa95d419b368ea7a950d26881b
MD5 41cf59ab1a8b89842626f8e9fc5fffda
SHA1 43d64102261474ba0b245e0ff247014f7c87aef0
SHA512 1ad35e77e6953b7b206c8626b33ac0338c77ab00a507dfae9dbb45edeb2bc410a9ba1eb86d76badb1e1f77c315d52587ee53025012219a7baf88721416eb543b
TLSH
T155317CF7C7D8957D890156F4AB156F2BCD290D19531D3C26C8E4AE1F97E1871D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 268715de1fe05411bc10c989261d6e422255c9df8b68928221de7c107ddbdc64
MD5 0ba3543dbf45cd166edf935ce3d269ab
SHA1 f0c743b562f3c4af446b68482c162ac221601d78
SHA512 0ac02c5a82cb3179d3c6363fee2a9ff8248924e1afa6e3e2e0c90165136551b1b22f41fc23d0d8e09f1cebdd82b37ba70946b5043e4cc546da87158832aca899
TLSH
T183317AF7C7D8997D890156F8AB156F2BCE290D19531D3C26C8E8AE1FA7E2871D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c0a1f4b3932dc5b11f8a25e844cd3ee668f985f7547ae69ba28357725f9a7a25
MD5 5cd120e6b252cc1e94b0d11d5bebda92
SHA1 5f6aec66775d23f041ca1211b787fbaddc1b526f
SHA512 3929c8eb02f0d34942dcf85e2a108e6aab654fa1037d3e370c4282896655e292d30e66f90db7afdba5e084b593ecc838d9031a1987e8c56d663f1a2d2a9a8847
SSDEEP 192:5R7vqgW2v7xAPRp2x39SHsb+WNnn7hDH2leEm3kwsOVyIsnAUgR:5R7vqCIXQEw7t2lk3XR
TLSH
T1FF32A72EA914793B6DDBC62AF9257B93E7F6002235D02E88E7FC892C24D35CC6217517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 868ad92106d60ec1c652b56c0267fdae359e490e734af08337833e3fae818e67
MD5 c58676173f36b93b54a368ef2388201d
SHA1 c3cbd5cbd230534cb9efd70f1f792a5d0d7cef82
SHA512 cb64579f9ae645727fa6c322a00cae7bcef82d2c0ed64a43dd652ec1538b431025080cf2a15f5d070f99451d54d8e4203862761effe50b84aeedfb15666894f8
SSDEEP 192:5R7vqgWxv7xAPRp2x39SHsb+WNnn7hPjVaweEm3kwsEVyIsnAUgE:5R7vqhIXQEw7tVawk3ZE
TLSH
T1E442D72EA914393B6DDBC619F9197B93D7F6002235D02E94E7FC892C20E35CC6217517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 19e9f3755ccf5b76d43da15141eb78285a21b429a083f691dd4cd6835fcb273a
MD5 05fb29847f212823fb717bde6c839e0e
SHA1 3f8ae4328bd28f742805310cecea6195acf19946
SHA512 56413857bf8626a091bfb9665c0229cff887e3dcbda59065dd4c485fb6e559c8e35e3c9769dc60c27ffafe2b5a66d6f91c418a1c72ce8c3366297906904eed21
SSDEEP 192:5R7WqgWRv7xAPRp2x39SHsb+WNnn7hFkQheEm3kwsEVyIsnAUgE:5R7WqBIXQEw7kQhk3ZE
TLSH
T10642D72EA914393B6DDBC61AF915BB93E7F6002235D02E94E7FC892C20E75CC6217517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9fe1aedb958ed1cd0938e3e51fac09ff2ce340aef1687ee607d1726cf77430bf
MD5 cb8ce599021d54e7cad353e563a92850
SHA1 00e7a62e66a1cd5f36160114ffcd1b5934a468a4
SHA512 1b3dda7a5fa758236834df4c6176d51b1158be92d68379b219f0c2fe0345a004184c1d46ee8a7f0206a183492fd77c5ad3f44c81c17179fb914837f450ca1fce
SSDEEP 192:5R7WqgWRv7x7PRpWx39SHsb+WNnn7hnziteEm3kwswVyIsnAUgE:5R7WqBpXwEw7hitk3LE
TLSH
T13342D72EA914293BADDBC61DF925BB93D7F6102236D02E94E7FC892C14E36CC6217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 9ebabbc9279cb4f69cce8ea8b4fea16c05dbf87a95720782a40e2e43cf758782
MD5 50196eb19ed6054f6d0b2ccc47761cfc
SHA1 9e29466ec6ae812224ce4518fe9d29f952eb1eeb
SHA512 6e8fe1d4d23872ad725209f29696f2be2b45019fb5909e638a33a46c18c66e7319092c5627a196be8574cb0d410fcc3faa1756eda75607f85787c369725b210b
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9o6y/kLUK/:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOM
TLSH
T15032D827A48D5A3F0FE8D40DD8136F4B6DB6429263780D2497FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 30aa1c1587caa33cf49687762fd49eafc1546bbb051c002004491e765e5ab457
MD5 d1d5e9ac5758cf43a747cc01e7862c33
SHA1 53ef9b235546458bec4a622a53d74035dc749b48
SHA512 5d5541cc48a0c21c8e7e5ca015a775283b7564ee41043b56462b82355b4dbc195f434af400f301ca1309e5c59c8a260496a4835d49f2dafa86e32a01ee6bf0f6
TLSH
T139A002161150A475D05846705B9203423B6559200711074741F54085985C7878205750
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1504f144445b4371bc16c82091d4394ba10241529ac2464c9fd053407dc781b0
MD5 5704c5ba08fdc4e88fa4ab8924d362f8
SHA1 f59b241135f5130c769504791689b889d5adce18
SHA512 e6c2eb692ebd730464f71871b5e512e7e95b850d939a575fbf3c417a2f534c908c9fbb1323647358ddbdebad179dfb93e987ca926e725602317cec2cd7d82530
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f2a92767d161d2407ae49d0603f9b709ae6026b495e321524e63cd2ccd256aa9
MD5 8b469ba011521eee2d0a5b9af830631f
SHA1 9aac76c944ff8f59b5b63777ad77dd684777b86a
SHA512 e8836cf90621203030a2050e07f44bc53e275390e3de0cdd387874086330425bade493a09873d3100e4cf6b118bce9ea6b7c36925bb8aa623ff2e4b5fb09a6b7
TLSH
T10EA00211C3C00416CD4152B5B5610553E361DE14166AD3437493144CD86F5CA55056C0
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a42b7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a42b7.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 06897e5a5901595585358de4e10449f12b47f62ca9b5c3bb2c096f832d6aa111
MD5 4113838daf861948a568971e29dd83e1
SHA1 5587a26a41eadc88dd84c93731a149bb477cd0d5
SHA512 f1c79f44415141b8c0eb05b45b08b608ff6053ca0d9d4f82c55541e5adb202f08d97bde117b76cd4695b7823378b429d6b6598c4c42d42d3d17e0690b9cbaf4f
SSDEEP 3072:1MOj+PYnHNK1aX35jNAFBojW/B1zZZ6otBQJ39C2j:1MOjfntnAFzvVMoi39CS
TLSH
T10BC302F28C6D69E12E94470450892F4FBDF7E8CF59B4F629C3E41F9A02537CB8206669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 c365dbf99d4799b60c9219b0661cb082812d2a155d343e254b32435d8385ea39
MD5 7fa1ba55c682f24297255c4b33db789f
SHA1 c2486f1a0798489565cfc609f98baccea0713961
SHA512 83c7f8f9df37a405cee19b1ffe65a73a2efabea8401241f35a014164d570431f1cb6c3d1f095ee6d56c5f8aac4679f133e0a1dc4859246492359a5ea8bb5ad3a
SSDEEP 3072:VMOj+PYnHNK1aX35jNAFBojW/B1zZZ6otBQJ39C2j:VMOjfntnAFzvVMoi39CS
TLSH
T124C312F18C7D6EE16A88831450CA2B4FB5B7E8CB55B4F675C3F81B9A03937CB8205259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 1f3970030cc54f1cc09d3aa805a1e42d78b2ac897a5ebf904cf420db930cc298
MD5 5e50e4a2ede6572e30701267c76fcafd
SHA1 71f19e7adc84e490ff203c25f4f29f4ad65c63c3
SHA512 e12b6ff40d659d21afffc6f2057c971bfccee6150790df558cdf23e883a6b25d89e9010dd5a0c1286b48b38a30bcf0bb0c7f3689ecd446da13392367c3663817
SSDEEP 3072:yMOj+PYnHNK1aX35jNAFBojW/B1zZZ6otBQJ39C2j:yMOjfntnAFzvVMoi39CS
TLSH
T170C302F28C7D69E12E94470450892F4FBDB7E8CF59A8F629C3E41F9A02437CB8606659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 7487ec66a1861b71f242ff86469f4f1ab30f6e7753c06f85443355eac15b010c
MD5 e79151d343040418fcfa6772042bb64a
SHA1 c99591ef418cab28fd23eccde8204be33a75ed58
SHA512 77077f40441916d942308f2ddea0c85c2180cf366fb9a99800743a6bb0b61a6fd46339a827a24eb65fbdddfef648e7f8af051472482646ac2828268518a4d82b
SSDEEP 3072:TMOj+PYnHNK1aX35jNAFBojW/B1zZZ6otBQJ39C2j:TMOjfntnAFzvVMoi39CS
TLSH
T11BC312F18C7D6EE16A88831450CA2B4FB5B7D8CB55B4F675C3F81B9A03937CB8205259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 766c95bba1e34ca9f84e311c880e951a37b5220297744a718e61a9ccd56523f9
MD5 43c2ae110339af8eb5ac766a28edc117
SHA1 3b8919922c29bfb98281ddac1e85d27f6664bb28
SHA512 126ba6520fc9df5b73d1eec42ab9da10823372f9bb04d073e833dc37d2c344ebb766a79ee07dab375aa4ff339087c75858ffe3fd93ac26ed2610455cd648faec
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok529DUB6EGyvP/e+0fZPEOLv4a:MC08UR5rYv3eDUDEYgae+0fZsOP
TLSH
T1F7A10873A46E8D7BA976C48571462B43CEB5B07FE561AE94EAEC1F0C01EB0EC1301623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

overlay.min.css

Path C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\resources\app\overlay.min.css
Size 251KB
SHA256 5946386d97e225440b138d2e0b09175f53131f0c57c8c4b697e13e70dcaff1f1
MD5 9978f01798e346381d00824dbf83c0cd
SHA1 5a7aab2cb9180d6068d4de057bc3e798902fceae
SHA512 fd3ab73ce56aa63de1d2e284c87caf7002fdcc959f9e9c799430d11a1103b3ce9f5a194ed0c98c01759942c11ccaef687162eb4aed68907aafb3e4ad23fb1957
SSDEEP 6144:Ps5ckuqaj+tQLMeiBdyF27YZlMd9dwEoPQ4hUPGSQStrkKs1s1CBM4MWh0b46s8R:CV6JGvuX4JSWEhCtcJDJje1
TLSH
T1E5447395F22DE57F7C33607992DCE88C620AB181DE124BE8FA12A53607C77F79C62614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Medal\app-2631.357.1\resources\app\src\assets\overlay\logo.png
Size 5KB
SHA256 eaf599ffb16c1fc6e8e054c1a18701b2f382b202264d43670385f367e5afe7da
MD5 cf42a6a04e1969e1a90404d8f7450621
SHA1 ef4366baff8df78c2449d8c336c2f400aa058483
SHA512 1c3aad3ee12b322f44d1e5090077f38d1948a363e512aef3cd58f589085ffc288ce01b240650703a57fe67c88cd4c6a1f1a243283ac8661c10d78847a13df6c6
SSDEEP 96:sSxeiTYphHmHNWVTNyRZ+2G0SSPFJfmN3f50gMWvw33m9l:sSxeoNayRZ+2GlSPzfWvCovCcl
TLSH
T129C18DC18A022E2BC1671CFC708F979839794F0DA77662EF735871790F1A2BA41625F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 5KB
SHA256 c4e353de9414b9af2c8b7e9eee24ad73fcdc9da2662dec9f0ec95ea6612f0602
MD5 871dad2aa61029fd759b25c73600eb73
SHA1 6e50dd13852c2ee4bdb97b92625b08028b3d20e4
SHA512 e5b9385522000aafa0a47f4ef6d07f9a62197a7cb94ae6f1cf70cf5c0e5ec5e886b5f4c838e9f57e8671d08d11887b70ca6754a030e89072ca97a9ac7516fb89
SSDEEP 96:fxf33Pf3YDyVp80hcTg25N3rHRomt4nnm1Ctpp70+nuS3jvHOe6XQpvpWf33Pf3n:5ng9zg25N72m6m1ap7nnFz/OhgZQnMe
TLSH
T112B16C7E84294530D4371134A7592DD7426F8EB2009637A9ACACFCD30A29B8E186CCE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.txt

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setup.txt
Size 68B
SHA256 a40d9cfc14d048673ad0759c2e4d354b8d6423df60504523ae5228fa0f84bacc
MD5 a3d16d3e0c99a8ee9e35e4232e97e13e
SHA1 f1073acf4ece1e22d5975f06c799f8f23bea8780
SHA512 1809506d635c839f22f8ec435e205eb6bdb8820fb375440cffbcf6887cdce5a43e55433f5bfed395092e36a3918b50aae3c784428785b8a140e1cfdfbb790477
TLSH
T14BA0220B80CFEC0B20223003E0FC22CCC0A2A8C23A003228CA088800228CFA0E02E003
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jafe2n5i.hlh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jafe2n5i.hlh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5BF3.tmp\FindProcDLL.dll
Size 4KB
SHA256 2ffe1ac2555e822b4a383996168031e456f09f9cf3bb763fccee35be178cf58a
MD5 ba4c1dfe226d573d516c0529f263011e
SHA1 d726e947633ea75c09bba1cb6a14a79ce953be24
SHA512 73d607f0cc27eb3b1966911edf669417249bbcaa2d07f037cb3d3d3eaf368110e7e683d0e2186b06820302cd17041d5f60adab1d0ad0ebc03e34075cea37f5f8
TLSH
T15581C8BA56E64FFDD1940A3030CE7003EBDD74A116AB626BC83B651A7BD00D0D438632
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5BF3.tmp\System.dll
Size 29KB
SHA256 022d071f7a912bb27a17f8eb15a4212d901dfa449956da12a06ec4fea80f924f
MD5 0b4a3cc51edbac39f7b17a4f474af2d0
SHA1 d588c845e64ba72419b16606dc7bdc5b0a172082
SHA512 3978e1ba4603e821e75c7b9cc355bb759173c341315b9b6a1d54f189f042cddd1868e9a47a4325dfa28155120480cf26ce1dc1373286c0675e977fef848f3fd6
SSDEEP 384:Achls/EvE2XYBVtQQA+S4n+7g6ZxlU7RfYkvIZMIwwHnY9py2ediASIo:AmHckOVih+S/Fxq7v4HnYSoASIo
TLSH
T18AD22829FF0BC8B2D1B655F049DFFB77482A790547225E6BEE168D08BC33A139A19107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp5BF3.tmp\nsDialogs.dll
Size 14KB
SHA256 d38eec01f3ac165fabd1a7ec3f257e87c54f1041599469e23021a38801013567
MD5 47850d09ab22fab658e11b18f2b3e24e
SHA1 12026b2b4daaf25bbd7ec4cc56139bf9f6816a2b
SHA512 6a5377676197005eb7b4178939900e9da8a2a6260b8e781e9316b41ac19263e0dfff3082a07a6152fc974801edef6af0807edf7ec237d465f2983363129fe387
SSDEEP 384:ZqWL5JCYXh2OPxv9OIR6oYkvLlwgS+6X9jN:ZqXG2cLR9v6gmNjN
TLSH
T1B752D50DFB1B14FAC571D974958BFB3F8A9DA415C62B4E06EF060B0CBD922B1680E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1540_440079598\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Medal\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

7c38c230-d9d0-4287-b768-33e8cd545489.tmp

Path C:\Users\Admin\AppData\Roaming\Medal\Network\7c38c230-d9d0-4287-b768-33e8cd545489.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Medal\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe5ad860.TMP

Path C:\Users\Admin\AppData\Roaming\Medal\Preferences~RFe5ad860.TMP
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Unconfirmed 468749.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 468749.crdownload
Size 16KB
SHA256 8a37e5c25c6b387cff88bf52d4a0e81671780e8fd3078767712d09f68019a462
MD5 e640f2ec559ecc08624bc4afd8cdc0ed
SHA1 4d115df756b524e54f2ebb7898fc364937a0c339
SHA512 94fc1936f1f31f58072c04908518cb26894f1da859afb2d408fe08c85e601afb9e50c097a1b9071268d7d4b2ee4be7ba5ba552291f8c0e03ec78a109aabdfb73
SSDEEP 384:ibzWX7jWbrnXZiOIiVXAMbMs/k3aZzOLyKsYF8/aQzmBPS5l:UIZCPbx4Akyb/fb7
TLSH
T14B726D379610A115EC3641347BBAE32669FDFB7E539A06978700045CDDB09D2F72A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1872-4338-0x00000000016D0000-0x00000000016F0000-memory.dmp

Download

memory/3304-47-0x0000000073D20000-0x0000000073D2C000-memory.dmp

Download

memory/3304-4-0x0000000074109000-0x000000007410A000-memory.dmp

Download

memory/3304-46-0x0000000074100000-0x000000007410F000-memory.dmp

Download

memory/5064-1050-0x00000000006A0000-0x0000000000876000-memory.dmp

Download

memory/5064-1203-0x000000001B610000-0x000000001B61E000-memory.dmp

Download

memory/5064-1202-0x000000001B640000-0x000000001B67E000-memory.dmp

Download

memory/8720-3228-0x00000000000E0000-0x00000000002EA000-memory.dmp

Download

memory/8972-4371-0x0000016FF6DC0000-0x0000016FF6DCA000-memory.dmp

Download

memory/8972-4373-0x0000016FF72D0000-0x0000016FF72F4000-memory.dmp

Download

memory/8972-4372-0x0000016FF72D0000-0x0000016FF72FA000-memory.dmp

Download

memory/8972-4348-0x0000016FF6E70000-0x0000016FF6F22000-memory.dmp

Download

memory/8972-4347-0x0000016FF6E50000-0x0000016FF6E6E000-memory.dmp

Download

memory/8972-4297-0x0000016FF6DE0000-0x0000016FF6E02000-memory.dmp

Download