061b066ab8040e56f27efc76b122301353c794e012b4eaf5de04aa8a8933bd68

Analysis

user interaction
yes
max time kernel
40s
max time network
42s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MedalSetup.Njc3NzYyOTMzLDEsbm9yZWY=.exe
Size 144.3MB
Sample260705-vlq3dses21
SHA256 061b066ab8040e56f27efc76b122301353c794e012b4eaf5de04aa8a8933bd68
MD5 ebdb099e74cf648b900a84dc3f3e45f4
SHA1 dd16d301f9a9417c38ef2a68ad0818d8723060db
SHA512 0eb5e65592ca373b09aebb3af1bbf4c03a71bb390c99dcf2df341001c804f8cca92769ee923e0c3572c9b05c553185bccf108a2a7ecf65d021ed64afd3bf1e08
SSDEEP 3145728:GApzdBEqmFwlbc1f9C/UWAMZ8sR7ZlMsiay1b08LTNZ+1C3aPVWtur:GmdCqmyRUw/VtF9cFaibjL+Kaotur
TLSH
T1B87833B43AA194B1D2F8CBB6EE60972C267E9DD77E060D85BE5433419F3CAA6C01510F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Medal.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
5748	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
6060	Update.exe
3168	Squirrel.exe
6012	Medal.exe
5984	Medal.exe
2140	Update.exe
4080	Medal.exe
3468	Medal.exe

Loads dropped DLL 6 IoCs

pid	Process
4080	Medal.exe
4080	Medal.exe
4080	Medal.exe
4080	Medal.exe
4080	Medal.exe
4080	Medal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MedalSetup.Njc3NzYyOTMzLDEsbm9yZWY=.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Medal.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5724	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5748	powershell.exe
5748	powershell.exe
5748	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	5748	powershell.exe
Token: SeShutdownPrivilege	6012	Medal.exe
Token: SeCreatePagefilePrivilege	6012	Medal.exe
Token: SeShutdownPrivilege	6012	Medal.exe
Token: SeCreatePagefilePrivilege	6012	Medal.exe
Token: SeIncreaseQuotaPrivilege	5748	powershell.exe
Token: SeSecurityPrivilege	5748	powershell.exe
Token: SeTakeOwnershipPrivilege	5748	powershell.exe
Token: SeLoadDriverPrivilege	5748	powershell.exe
Token: SeSystemProfilePrivilege	5748	powershell.exe
Token: SeSystemtimePrivilege	5748	powershell.exe
Token: SeProfSingleProcessPrivilege	5748	powershell.exe
Token: SeIncBasePriorityPrivilege	5748	powershell.exe
Token: SeCreatePagefilePrivilege	5748	powershell.exe
Token: SeBackupPrivilege	5748	powershell.exe
Token: SeRestorePrivilege	5748	powershell.exe
Token: SeShutdownPrivilege	5748	powershell.exe
Token: SeDebugPrivilege	5748	powershell.exe
Token: SeSystemEnvironmentPrivilege	5748	powershell.exe
Token: SeRemoteShutdownPrivilege	5748	powershell.exe
Token: SeUndockPrivilege	5748	powershell.exe
Token: SeManageVolumePrivilege	5748	powershell.exe
Token: 33	5748	powershell.exe
Token: 34	5748	powershell.exe
Token: 35	5748	powershell.exe
Token: 36	5748	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6060	Update.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 6060	5384	MedalSetup.Njc3NzYyOTMzLDEsbm9yZWY=.exe	87
PID 6060 wrote to memory of 3168	6060	Update.exe	89
PID 6060 wrote to memory of 6012	6060	Update.exe	90
PID 6012 wrote to memory of 5984	6012	Medal.exe	91
PID 6012 wrote to memory of 5748	6012	Medal.exe	92
PID 6012 wrote to memory of 4000	6012	Medal.exe	93
PID 4000 wrote to memory of 5724	4000	cmd.exe	96
PID 6012 wrote to memory of 3272	6012	Medal.exe	97
PID 6012 wrote to memory of 2140	6012	Medal.exe	99
PID 6012 wrote to memory of 4080	6012	Medal.exe	100
PID 6012 wrote to memory of 4080	6012	Medal.exe	100
PID 6012 wrote to memory of 3468	6012	Medal.exe	101
PID 3272 wrote to memory of 3328	3272	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\MedalSetup.Njc3NzYyOTMzLDEsbm9yZWY=.exe
"C:\Users\Admin\AppData\Local\Temp\MedalSetup.Njc3NzYyOTMzLDEsbm9yZWY=.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5384
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\Squirrel.exe
    "C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:3168
- - C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\Medal.exe
    "C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\Medal.exe" --squirrel-install 2627.293.1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\Medal.exe
      C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\Medal.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Medal /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Medal\Crashpad --url=https://sentry.medal.tv/api/1378175/minidump/?sentry_key=c8a362b2878242408b487aafa89be8a7 "--annotation=_companyName=Medal B.V." --annotation=_productName=Medal --annotation=_version=2627.293.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=40.1.0 --initial-client-data=0x458,0x460,0x464,0x434,0x468,0x7ff6a63076b4,0x7ff6a63076c0,0x7ff6a63076d0
      4⤵
      Executes dropped EXE
      PID:5984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "Get-CimInstance -ClassName Win32_VideoController | Format-List -Property Name, Description, Caption, AdapterRAM"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4000
    - - C:\Windows\system32\reg.exe
        
        reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid
        5⤵
        Modifies registry key
        
        PID:5724
  - - C:\Windows\system32\cmd.exe
      cmd.exe /q /d /s /c "fsutil ^"dirty^" ^"query^" ^"C:^""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3272
    - - C:\Windows\system32\fsutil.exe
        
        fsutil "dirty" "query" "C:"
        5⤵
        
        PID:3328
  - - C:\Users\Admin\AppData\Local\Medal\Update.exe
      C:\Users\Admin\AppData\Local\Medal\Update.exe --createShortcut=Medal.exe
      4⤵
      Executes dropped EXE
      PID:2140
  - - C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\Medal.exe
      "C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\Medal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2072,i,1226733127602267175,9876491820090075607,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2068 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4080
  - - C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\Medal.exe
      "C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\Medal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2072,i,1226733127602267175,9876491820090075607,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2408 /prefetch:3
      4⤵
      Executes dropped EXE
      PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Medal.exe

Path C:\Users\Admin\AppData\Local\Medal\Medal.exe
Size 458KB
SHA256 8e36241e31b67acfea735f595a3fe2d11cad7eb316d0ecd1c007cba0f73ff6ac
MD5 9e118ee938dd58b03da4949804e4c073
SHA1 ea5336961fa6fb57c89e5e42480e4f50e92e8e26
SHA512 d2601233b1bfbcbac79295eb715c3c7810a1aa13a3bc04bc65bf049c8f01c07b4abf9fdcfd6ad5b3d2fc8dcf94f291f7a8995517025d8d67a0abe92931eafa42
SSDEEP 6144:iPhyu7B9Hz8TJPm7/qJ0AOrSwAS3N5qADSQi5o+RQ3qL8dRtuo/WnY:6wMATJPv0AhS3NHm8DrWnY
TLSH
T142A4F99876A25473C5B40AB15FB0EFD8423A5FF33F08219672433A6A7D7DB42E51B086
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\chrome_100_percent.pak
Size 112KB
SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
MD5 129f8cee761c5bb414b2270356177f6c
SHA1 0a10b55daf24c7f9fff1b22f853dd87a98433b7d
SHA512 33f4ceb0ed18b2172e2f6d203ccab2954dd900592b2e62ce4a1019ab9404889ebdcf462a2479f1847c01b2835473e83859c77816e83ef76ee133990be3d55eb4
SSDEEP 3072:DS4PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:LYWFUbGz8LI1TnjQBQCrC
TLSH
T136B3D0D7B3B09D7DDA460BB783560170FCB31B2D06C2120A5A9AE479652BF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\chrome_200_percent.pak
Size 182KB
SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
MD5 ed7b4e5eb15a086ce7e117a3228e3f15
SHA1 bb6debc27ed4e2f20149a17e36a24ef4482a96a7
SHA512 7278e0acdd8a1806bbdfd147d5439f7f849fbf95f1be1ffb741ea84cecad2557469e99f91cca66ce36349a9aa55d0107e34b9499b8fcb3e7fb3a8bbf84c1e911
SSDEEP 3072:CJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:7GQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T1EB04F1D723B8AD3DD9570B73926610E0FE7A20291EB3110A5A9FD8397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\d3dcompiler_47.dll
Size 4.5MB
SHA256 2821ca3bcf58c90fd9c7109ede742dd6589fd378dbb51b1a676d252fcffe3fa9
MD5 08d1125e520120ec42a0985f72c25c2c
SHA1 b3098f04dfc16dac6b54cb352f5acb980a86a268
SHA512 7dbe6c3427c67e9c599a7aa392287b7c67318cc83c8b452c07bcac64786777ceb8a9ad63a86e881f6931450f3c8631f846c878714b964c6c0893c1f174299c94
SSDEEP 49152:SSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqf:9uktcrfNlTyj5byqSs
TLSH
T1BE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\dxcompiler.dll
Size 24.5MB
SHA256 40a41eec9d90fa1e348ed1b5d398a94aa6203b45a08126c1d3aad39941ab3225
MD5 217ee733215e738f2777970f852e8dc4
SHA1 29f4d1c1e605f4d1a5e3276be02f58ddbdc74aa3
SHA512 442bd7d44fd6eb0f6bb8894338322691f9052b0e48cc70cac2d28966f9808b8a2cd02d0ccaa7ad6c8a04e9e8a576e90f58716db1a83687dcbbc63c4d6e03daa6
SSDEEP 196608:Tsq7jjh1u1/1i9iJj24AD14c9TR8Z6GmfozCEJdXqaqR:Tsq7jjh1u1/Dxc14e8Z6GmfyFqa8
TLSH
T1234729122646D49DC059C879C7678B268A6C30E73FA7B8EBC0F451252B79EFC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\dxil.dll
Size 1.4MB
SHA256 681099c2c9adb30185438d89dbe5d909cef07f621a1dbc5a1919ccc653fe1b8f
MD5 d0b5b7ac910572bc96c2b023c43a2720
SHA1 02123d63f115428471b0a00d490bfe1d00267d6a
SHA512 f8eb1ed7ae1705baf1755c1eeb65f0da334cc5811dcac45cbb09533e4942bb2dda8fe599311036733e184ad61eb70fcdfa0ad19b070438132ba2ebf759e7127f
SSDEEP 24576:tY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kau:miTMYxy0Sy66Zh7Sh/cyvS5o
TLSH
T1CB657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\libEGL.dll
Size 523KB
SHA256 f624c04a9d951f7e7a899699c7dc14a28b80e788c38bf2236b301162a20d7e05
MD5 34f09783c5f0a54a60586a2d9154c224
SHA1 0e130da6ab43aa7edd622de0dd35944ff498d860
SHA512 7af418b798b131e6f566d8a0d0ee373b58c8b62c509641dd2dfb801a316171dd9f32509268e92cecbba41450a51c573c216e8397df738f22bc08276543a68f12
SSDEEP 6144:8Q4VIVcVQMLMVwCtKpDaLnjSFeN+a+BAiLm4LiE0z0WhcEuvBLPdvtYPqQaq:8n0iCZjF+CymG0z0WhcEuvRltYD
TLSH
T186B48D15F3E84BA8D07AD0348A438642EB7574960F65F9DF02E052792F3BBE45A7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\libGLESv2.dll
Size 7.7MB
SHA256 6f69703aa59f5c221817c55dbfc39d9ae1a6ad200e80e9cc58f7ae79b524d578
MD5 7df8b5e3cc8da859504bd9c4d85f0d48
SHA1 d746636c1e4c509f56b2c8f7b7e53558760ad646
SHA512 10349a261577c5375a73fd2c8d8ee4ffc8b3c394122f0e3583eeaa61c7d09522c40b58692c6d3579f21cf9ed1b4a0e2d253a96fceb77ad70e7f57b22a955553b
SSDEEP 49152:kupJ61ZvUdnnnzCwAOqBmONJAbLfkcO0VsWkgp9rnnG45/ifbKnNdCusheIYklbH:veCXaoJl9aWNd5JIBhhpJK1Ixe2l4g
TLSH
T141867B03F69680D9C05DE278875BA627FA34B8450724B7CF2A9453162F66FE0EB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\locales\en-US.pak
Size 537KB
SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
MD5 0604e26677ebd9417c7de4c421f6254e
SHA1 ed023212b6951afcd80ece283d6ddc68b663e079
SHA512 8af64b75a40a6dca6ac5feef06ab5e8c898bf30b50be73e480df923461d42e2cc417bad5151eb957c9606540321e0dea48820b2c5009408e0420e1ebe1b01a29
SSDEEP 6144:K7dq1yx5HfUOQkbaqMP9qQ0BFfaYQDp9I3AjkgngP8/I2wf:K74k5HfCqM8Q0BkTjzwf
TLSH
T1BAC45C1FF744122A059352A2BF099562FF32D06CA35112663CBD812C3376B6AD3B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources.pak
Size 6.1MB
SHA256 ce5c35017fd7aa648fe44381711cbf42eff5f6923b11241a4789058dbc5b27aa
MD5 79762f4295600653dca20bbaffeed153
SHA1 85b8ab7d9e7fa663dca0babd1f72c79a1f39d99f
SHA512 13784fda38785e3dc23b118969478c61040e81e1271f6ca7d7536ae60872b1adc9f2a99e15fc17e5c4903046eee8508b686fa18092cfdbd1c0a29b79fbf18484
SSDEEP 98304:5vjQ8HDIPJ132R3lW4uKXegybAHltND8rwri0J/xUaAUXLPC1GP4kFbG:JB0BRulFzPtND8kri0JlAYz4kFi
TLSH
T1985633E1B7A06CAFC5484379D19542343A3ED95F2581739A188CB33CED6D91EEA4823F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\index.js
Size 984B
SHA256 7fe5245bc82f099828bfecf7f78e4c417d6a20fc97ccbf30ac17bff7396aeec9
MD5 ed1be6152752554b6a465aa75913a099
SHA1 b6b0a55907a09ea1772c7dddb9fa912e12f52f87
SHA512 f8b1ee59576fac44095deef9bd3d5c5a1b5901c2453d0378b96a40f77f52ae666585847af85888d8a8e2cd2a09745c16c28098b3f5c415f86a906ae275848e66
TLSH
T1EC1154C5A5FF6551AAB183AD302B02B9FA36832226A32361B86C97072F55650631383E
MD5 SHA1 SHA512 TLSH

Submit Download

main.min.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\main.min.js
Size 2.9MB
SHA256 d3eefa90106e95c805a515478202841b6dd7baddd492b23e76fc95a78fb3b509
MD5 2b98d98ecd4264ce4f6841a841e6d6c3
SHA1 19fc896ed1b7f7a755eca2f1c3ce5e38f5991317
SHA512 b0e6e218f55dbace35cd465bfe8b096ea8c89b514810d1bfb91f900b4e84e35f0775c37c38f24521b9fb90f243d01f81d30640bca9c09c39a7d679d03e3e8af5
SSDEEP 49152:3xGw4xThR8Jy6gpg/y2pc4CahUq4NOfvPhR3NCmxyk82PUaT1R16d62lxwvAPC3/:Rb6dlkEaEedeC
TLSH
T166D55CE6729674724BE350E5943B1002F339A858740C8468F3ACDCEB3AA994D6277F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\index.js
Size 796B
SHA256 924564d5be26d59b9682c4263f68320e48dde7240bd2d1ad17ec305537429dd2
MD5 a15f5d41d74ff8472614c54d87841f64
SHA1 519557fda97020cb2a4c7aeffe7f8edf03e536d2
SHA512 89d799e4281f6906c46b1105b50bb0baf9d9b09adeaace3b48f8a4071f951350cda2ac56f8c47fef5fcdbc1a1d5a1ca139f7c10c547c066f533aef5e5968e0c9
TLSH
T1B9017590D5B5A5D930F852D1F96CF0C1B7978148FB0695C1A67CC7E3648B08C5B19FD2
MD5 SHA1 SHA512 TLSH

Submit Download

buffer-util.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\buffer-util.js
Size 2KB
SHA256 8b0a45739132f82e25ea13163780abf547ccfe989267f3eb7abb475beec92da3
MD5 8c25c9dd9f6e3773f89b9e32b7105c3d
SHA1 f7118209aa3e4032abdb8180519a3cad15f0de05
SHA512 bc2e6d02069d7841150e43cbfafc5992e3003906363ff38dbb2ad9c8d39af99fa47e1343ababad1f72d27e3e09e022b9cafa978a57539ab3da27eda4168596de
TLSH
T1D651144A2FE060760203F26711C75E8FA3748A05B657D945511D6F602FECA74DDF1ED8
MD5 SHA1 SHA512 TLSH

Submit Download

constants.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\constants.js
Size 503B
SHA256 391e823142b8b370e55a2fd32b022deaf03b8415c56000009674ebc86a0b4f86
MD5 22783d577f2ad3dfbad775128bcfad96
SHA1 b3726aae205316457c35cbbbc75b8dc73562e08b
SHA512 2103cfdaa7625d5a094426d0cfcce965f053a2934888db120a800c31322bdd5634f1988d66208c5431703fda6226954bc264fa5dddfc45cc81f5ce1ac2643b22
TLSH
T161F0592F1FD0B2BD9CB7500F5A6EBE45B8D15CA223CFF91550489EA8470C8401579684
MD5 SHA1 SHA512 TLSH

Submit Download

event-target.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\event-target.js
Size 7KB
SHA256 c45d3c6e12d170c860c0c3f1a050aa0f864d9806632b609a1e607d675aba128c
MD5 d02492ef6fdb35d8ad8af33f90c91fdb
SHA1 923aff1a440b1bb30658a2a3f9e3a9da6ceb0eb7
SHA512 47d8c788b7b57851e6967f9ee5a0d183800040e77f540720982e91cd992a03543f9014cbed590cdbf1c6c6a17f83e88aa3d797102db5aa6ae756e6bf4e0cdc53
SSDEEP 192:vcQQOMbplFo81yEPHNjAZvIAqishOoS6n/6LCcGxFa0cnrVSL:dMDtyEKvgiUPHi4
TLSH
T155E1DE492AF403F301B7A3BF770A7190D020D5EB622965E474ECDEF90F49AB496E2784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\extension.js
Size 6KB
SHA256 852564f0f6b460287043803eae732666fb5610f676874354fc89f06aa4e986ed
MD5 379b482fc8622cbf8731096e70734b3d
SHA1 af02e218b64fac9b65b54732ff593d62ae6bee5d
SHA512 6c991272627c0a452bd536c9e3604a9601d42f0f17aece0bd712df5c0fd5a2f3abc2bd70f025fa099092b7cf3946e2ade4c21e537720b8ac266196f8c813cbe8
SSDEEP 96:sKoor/fSpwCljhsZhk+FsqNB0GtPH+9xalu:sKC5BeZhkAxNyoPH+b4u
TLSH
T1E8D1019629DB22120A7F78B5DA0BE568D3780107720CAA44BD8C67893FD5E3583B5F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

limiter.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\limiter.js
Size 1KB
SHA256 e0469d4b83f6ba764b15f80e1766b75c136fbff68f048f4c050f0b1c7f065f69
MD5 7b8a8dc5be27a1bd1a39544cc28ae73e
SHA1 d56ca70e1a496b15e1cc90ac740679d7a6c37eab
SHA512 1c1731373a93c3d7f27dde4b6e06565d013ec7fdf6714ec3e1f5844752059a0790e4bc571f20301f45dc63a55e9129e304ecf3551791370c40152942caecd574
TLSH
T16111CE2606EE14E2D02321B58E6B6254E562110FB61FE8D97A3D13AC4F46F30E294D79
MD5 SHA1 SHA512 TLSH

Submit Download

permessage-deflate.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\permessage-deflate.js
Size 14KB
SHA256 02c31796f0132a335d4efe7b7adcebadbb69543a1ce65ae04aaccc3530e27ab9
MD5 607070f8184092407c7a63fac8c69f20
SHA1 9f9896dc0a4352671647ce41168fd790feea669e
SHA512 f9b361c89d6b73e72e3eeb4ff7ffdae3e98c9f3946d8c9af37b1a94812ec4fc3057e8bead1886d2532b38ad119eec6bff5a4075d2a7874a829a7e3ed09fe924e
SSDEEP 384:CxmZikcIjmNBu/OMiSOsbOk7OadYO7oFJt8:oiiDIaLZSOIOmOxOb
TLSH
T1266261591BFA026740E767E68FABA24AD330D01B352AD588395C53CE1FCDE34D399B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

receiver.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\receiver.js
Size 17KB
SHA256 4879edbf8e48d04d09783cf9c04b5e25f5a448247bb01279438ded2899747220
MD5 302d12ce5e6335659be9f6e231f351e9
SHA1 a2b39c4564bf12c6e1d34aadc126ed1ea56e41f7
SHA512 8523688eaa2a9771f49f9748acd86f66f40f92bd3f3916ec8e67b72837cb85e522a3f41dfb1be59f26400ef57dd7b20f5cf4a59e6eb06fafd4257581f0e44ef4
SSDEEP 384:/M9nii1yJZFf8xBnDXehQhYgRO09Mwn9T9ovb:/M9nsZFf8xBnDXehQhYgRO0hI
TLSH
T17A82F0061BF6116A4063B47A1FBBA51B6124601F390AE84C7D4C66EDAFCCB3488B5FF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sender.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\sender.js
Size 16KB
SHA256 d0791d30c3defd44dcabbddb879a901c757993fea2c00a7ffea01d53b23b4b77
MD5 7a315f1409590d624813f219d862ae11
SHA1 e094ebb398e8dd676f8f2f365064cc178ff12bf0
SHA512 e8dfad31c0f3deabeb3e26541e7b159ad5b52c5f697459c2d4b170126c2de46686964d3c112c03ae35e7f9cee7976377cc3113f01c39245d8916402d7d8883fd
SSDEEP 384:jDt8gyVX1U/cV7If/WbiwKLCibvlLf5fKm/JtBkvVX1U/mBmNJ8VX1U/Y8dL2VN9:jDt8NVX1URCiblLf5fKm/JtBkvVX1U/S
TLSH
T1217232191FEA126A0093B1A48EAF9057B330F22F7619D498784D7BD02F9CB7091E6FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\stream.js
Size 4KB
SHA256 a56fcb6e2b152097ee820b6f5410b1f71e59819b45d08d9f8bda588fe39070ec
MD5 06840a6e365bdb23c05dd958e4756473
SHA1 d3de11ef622c66ffc0ea4c2bdc114e85779d0db6
SHA512 89d9ef4ea0cc3ff80d7697229c2ef9a6c57d2308f3e0469cd94a1dbd2da2e0de1968839773f23c986efa6f91ec1ac3a960226f0427d9c0e0846b31ea6f0b2ee2
SSDEEP 96:/QWVMjxumJYNQ6gvRNYY/LDg5Ib0IxC6tIqO:oWVMNwgvb5zsqbk66qO
TLSH
T183812F4DE2BB126B6577B5ED4BDF83E53250C453112EEA40B58CCBA42F1E4340674EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

subprotocol.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\subprotocol.js
Size 1KB
SHA256 be3f6323d6f549568577dcba9004c1479d95c65a7abb0fe0c582875b9fac0b7c
MD5 942d99c9806b3423d8849530687d3d37
SHA1 45de2302a00451a68fb123f28faa3af105ce019f
SHA512 bbfa0495207e0222d726b45beff0189f8aa6351fe6068423213cbb6ee6661f2c869019a250ce81bfd13372a2d5ecd599b78f16e7950deacab78c5cec78291083
TLSH
T190311241A5E723894ABA3475C54BF991E3BD0206E14D8D483A4CD28B3FC59618FB5E81
MD5 SHA1 SHA512 TLSH

Submit Download

validation.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\validation.js
Size 3KB
SHA256 41ce8e83d0d434132e1704895fedb91f6703a701b42d91c80954ab29b2845593
MD5 fb87bfd1186d149f39b3a1d7948b9852
SHA1 2fb0c708af35d05a8206dd098d7b2d2515212333
SHA512 c0b96e19724df2d454bd1b21e8436b117429c03635f766fcaa561e0b76afbf681bb40e7e931ca954dfa0cff9108f52c8466cb702be88d1d424e7341219121e88
TLSH
T1B581BAC757D6212C0353C16D8A8A8C1B66ECD4B6622C59CFB84D3ED4DFA9560C7239CB
MD5 SHA1 SHA512 TLSH

Submit Download

websocket-server.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\websocket-server.js
Size 16KB
SHA256 29029a4d346800c792300df153df2007e9805d9d7b67b0883f9730b64f25b1c8
MD5 6ccc26822b7e96a71f7a15888ec1d076
SHA1 9e44cc257b331822dd9694801e507c6d74d23464
SHA512 72a60cd7f44ecea49890ea7fe27b50578e4296e4a142bdb000b8e33ad10bea1837d9c69b16fd383bec27b15da71cf3d9326e8aa19c7f805761c16629570b27b6
SSDEEP 384:6Dp3YNLX5NMpia3JUfWGdQT0DnbPEgQLDabWgD1sSZ5:6Dp3YV6p3J4dQTQEDL+fj
TLSH
T1CB72A945AAF623BE00F3E2D95A4BA451B338C1537306E495795C9FCA2FCF6B48261BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

websocket.js

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\lib\websocket.js
Size 36KB
SHA256 48fdb0f54c1f8ce580d3cfa2908fe7d96fe18f06f9d82306950441cb09b5db26
MD5 a3d873bc91b588b5ce78505549794716
SHA1 853865477225df4201343d9cf1c4583eaf8d228f
SHA512 1b1e83ccb53641b689ad38b45863733f386ce27d218d0a03ec72dd4ff498756537ef141636ec4327b9076962c7409a6f95fde5043fb645df45a2b94c9aa7239f
SSDEEP 768:774+FgTtkckOy1chyT+220GXNsdjg6N2GwGgiEOqkT8YwZkNercXd:7gTkT+220GXNsdjgCgZOqkT8YwO3
TLSH
T1F8F2A785EDFA13AA60B6E2B54B8F6485F330801B7316D5D8345CDBE86F4FA7042A5BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\node_modules\ws\package.json
Size 1KB
SHA256 584ce6e7516587ba249dc910b0c04e2753f6b3f451fc3a5bc324f7735bdacc71
MD5 fb5c34c5e2edffc3f31f4465740590aa
SHA1 98891dbb3b44c5734c567b72eba63c094e50117a
SHA512 314eab3555cc397a2ade5b627a38a4e99b9200b060fefeb7fb007fbc248efd836e682f9c4d65423d4c0835d323b5a31ffbf486b18257518e578bc2549ce1f85f
TLSH
T1C031FE76CC790EE30EE529A878A441527232485B5984FC0C7BD7431C4F4EAAF11FEA5D
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\resources\app\package.json
Size 9KB
SHA256 a76bc27e6fcecef481657be899669bbb696d643ed0de4cdd3c0d1b084fee7597
MD5 03ef33a0822889cf461a4729effa92db
SHA1 bf68e6b883799f57874bbe766b6ad3d7ccbfdfac
SHA512 515b961edfb10b6cc9cb957f95aac63eeee6b52e86be92955b97bba65348f981b5e64018e73099067be1a944d2cd4d65e1c000961d07d5e712c07fc849cf8d67
SSDEEP 192:FmTp5uJJN/r9s5sWOYTYkULnOa5d/PF98udvsC98TYvEYhA51x1saz:Gs3N5s5sWOhnbdHFBdkC9LvEs0
TLSH
T15C12617BCD498DB30DB6055A7AB82569F02E230F52ADC5CF3374536D0FB2A3A414A7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\squirrel.exe
Size 2.0MB
SHA256 9c9c39c36c3007491d19cfeb7ed3429d68e0a54a7cee919bbdc503471f89421b
MD5 4ecdc3370223e94f293e40e2bb801c2e
SHA1 a0799d388a33a6e167ddbf11bfbc4699fbb4854b
SHA512 4b955a3303e1b195cdd2e3a6bd79284029de12014a044ce13b11330177bcbf76cc6aa75f188f5cc29cb868ab889a56d962ffbf12b747f17bc9c85dbc5d02b158
SSDEEP 49152:wKf4kxKNMVup88THrE/HF3wfGHxF5v9+bp:ziTHrE/HF3wfoQ1
TLSH
T12EA55A01A7E88E3BD56E17B6A470269807F3DE973721F38B660971B92EB37109D02357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\v8_context_snapshot.bin
Size 696KB
SHA256 1df86ae706c6fc60bb6f4e60d76c5a3f56affa54e6b1442f51127bedc589d089
MD5 ac1ecab348d666e70d3bfe6877a43f99
SHA1 7e22faa7dd16b965c4af9e6b85b12a11d2060f19
SHA512 81bc684328821627718339eca626130380dad46c9c024df775d5356ca20a5fa9cc55b48f8e9d7ea244f065c86977c952a14c7dce29963f1c5afe1285bdf76d08
SSDEEP 6144:9af8tLrT5X3ukt+H92AqD9clxP2NyhaigNw69I3ndbkboE/UZ703yCTzrWD:9af8tL35X3usCN2NyI4NbkboE1rTzm
TLSH
T197E49761F71ACF26C6493A7D8DD657463930B2CE8E46E24B3406B33E78B96704D3662C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2627.293.1\vk_swiftshader.dll
Size 5.4MB
SHA256 9a8f8ea09999bcfafa52fa14ccaca9de9f03c0408826ee8d2b19ab266211e8c5
MD5 5ad9d62a58a966400c454bb7eb2a9b3d
SHA1 778e642fb021d167c6d2919f64f7b46c510afc52
SHA512 c71727aa0d01b89b6bfd1effe6de9d4e59f37d757173a6086e5f6dd879028ad265dfbfe861221adc2e0704a63cb2cec7badabc2a87dfe68d6ea8657df3cb42b7
SSDEEP 49152:3hqQRjgbS5A0V4NmoIb193Km3QIH6hvweSNerodqG5iBgP6zPPvT48unNHRVq45+:31gbID4lz8ZlwZswtwmdXnF
TLSH
T168463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 1b7fa96dc07ff49f962f8ad04019049a414a854825a2e9e68847a61e2f20666b
MD5 8992227a7d4aa05e0df6cb9f34af822d
SHA1 f3b01ddef4497a8e14bf344747ffed52ef671502
SHA512 028582162ae51a5c9bd42b1e7fac55789747d84b10c2ec6e8221df8eb3b38c2ca2d7b468af0c2e96584e2f11f37028f97f7f465fac02223988dcf17b4b8ab20c
TLSH
T1AAA0110C008AA038AC82CBC0A00BB02A8A8383A0B2B823C308280300080388A2AA2208
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 f227fb387354c36743d9bd9b64fecd7cea6cb26dca9e5090f0652187bfbc933c
MD5 c5fc191e938a531d5fbec1ca6ced97a8
SHA1 7583102ba521149b4468f304d4c218eb3d8c34d5
SHA512 f12c9b452998f80394283aa061062caf5bf4863ea60058dbf962f8164e9de9429c313ec44ab2d53fe6aa697614fe7568dbfa2ee0fd29e71bfb31ba5368d1dede
SSDEEP 24576:jKBgsOuZ27kxKNMVup8gZTHfTE/HF3wryXg6UDfbXuj4Gx/TbBxaMt5vedX5KZ+6:jKf4kxKNMVup88THrE/HF3wfGHxF5v9v
TLSH
T12A956A12A7E88F2FE56E27B6F070105907F3E5866372F78B660CA5B92E833644D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 5KB
SHA256 c4e353de9414b9af2c8b7e9eee24ad73fcdc9da2662dec9f0ec95ea6612f0602
MD5 871dad2aa61029fd759b25c73600eb73
SHA1 6e50dd13852c2ee4bdb97b92625b08028b3d20e4
SHA512 e5b9385522000aafa0a47f4ef6d07f9a62197a7cb94ae6f1cf70cf5c0e5ec5e886b5f4c838e9f57e8671d08d11887b70ca6754a030e89072ca97a9ac7516fb89
SSDEEP 96:fxf33Pf3YDyVp80hcTg25N3rHRomt4nnm1Ctpp70+nuS3jvHOe6XQpvpWf33Pf3n:5ng9zg25N72m6m1ap7nnFz/OhgZQnMe
TLSH
T112B16C7E84294530D4371134A7592DD7426F8EB2009637A9ACACFCD30A29B8E186CCE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 210KB
SHA256 b224df52e505c1f0ea3f7a3257e9bebfcc2bc6970ab69cd9feab3af43c1dab33
MD5 3568c98fce9ef20d3f794eadb7f5fdad
SHA1 3b6fc8ad3e1c7f437f347d3da697164f9b99fad8
SHA512 45198e0f81eb07adb96b2032ac0b137addbf0f07db2655cdc33f8ee907c9a0a60f8891265f967a40ffa2c8b0f6b3f8248af1997f1728610602d942e6f0b43e13
SSDEEP 3072:OX8S3N7VqAD3iP4i5obSRQ8+IN9NPynLDSL81rgIJtuYSAECNxQ/f:ZS3N5qADSQi5o+RQ3qL8dRtuog
TLSH
T1F524D09C26625477C6A40EF59BB0BFD8423A4FE33F09218471433566BD7EB07EA5B086
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_f5b0rfeh.03y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f5b0rfeh.03y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2140-1658-0x0000000002F10000-0x0000000002F30000-memory.dmp

Download

memory/3168-1604-0x0000000000630000-0x000000000083A000-memory.dmp

Download

memory/5748-1645-0x000001D649920000-0x000001D649942000-memory.dmp

Download

memory/5748-1750-0x000001D661FE0000-0x000001D66200A000-memory.dmp

Download

memory/5748-1751-0x000001D661FE0000-0x000001D662004000-memory.dmp

Download

memory/6060-731-0x000000001CF60000-0x000000001CF6E000-memory.dmp

Download

memory/6060-729-0x000000001CF90000-0x000000001CFC8000-memory.dmp

Download

memory/6060-9-0x0000000000610000-0x00000000007E6000-memory.dmp

Download