005f5c88e37e355ed755267d02ab860a26c3e2e96265844ea3c3d65a7234899c

Analysis

max time kernel
151s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 21:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MedalSetup.v776386636.exe
Size 145.1MB
Sample260828-z6p32stdjc
SHA256 005f5c88e37e355ed755267d02ab860a26c3e2e96265844ea3c3d65a7234899c
MD5 6e85118aecb7f9e2e82f8cbbe9fd217f
SHA1 e6cd6774daf8a9ea9ccf7c5013240e70f99bad8c
SHA512 237116704bae334d6b6e489acec98ce62b200681c587b68ad1f40161abb388f581fa5650e10aa730ffdece17ce01d691e23d6f8faab4544a4b20de3aa8af709a
SSDEEP 3145728:k+pzyBEqmFwxPdHQm/r9c/EpnZw2gxCvWuQ1VMIko/Bv44++5RpDM7RcO:kcyCqmyFymB7bwvgOumVS2N44L5RZgGO
TLSH
T1E87833F805A215B0E571DA73EBF0DF60E43C9FA73E0A4A051A8A37A1DD3C5C6E45948B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
1092	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
2324	Update.exe
2836	Squirrel.exe
3932	Medal.exe
2240	Medal.exe
4324	Update.exe
2532	Medal.exe
4448	Medal.exe

Loads dropped DLL 6 IoCs

pid	Process
4448	Medal.exe
4448	Medal.exe
4448	Medal.exe
4448	Medal.exe
4448	Medal.exe
4448	Medal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5776	cmd.exe
2436	cmd.exe
4424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MedalSetup.v776386636.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Medal.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
944	reg.exe
1320	reg.exe
4524	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1092	powershell.exe
1092	powershell.exe
1092	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeIncreaseQuotaPrivilege	1092	powershell.exe
Token: SeSecurityPrivilege	1092	powershell.exe
Token: SeTakeOwnershipPrivilege	1092	powershell.exe
Token: SeLoadDriverPrivilege	1092	powershell.exe
Token: SeSystemProfilePrivilege	1092	powershell.exe
Token: SeSystemtimePrivilege	1092	powershell.exe
Token: SeProfSingleProcessPrivilege	1092	powershell.exe
Token: SeIncBasePriorityPrivilege	1092	powershell.exe
Token: SeCreatePagefilePrivilege	1092	powershell.exe
Token: SeBackupPrivilege	1092	powershell.exe
Token: SeRestorePrivilege	1092	powershell.exe
Token: SeShutdownPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeSystemEnvironmentPrivilege	1092	powershell.exe
Token: SeRemoteShutdownPrivilege	1092	powershell.exe
Token: SeUndockPrivilege	1092	powershell.exe
Token: SeManageVolumePrivilege	1092	powershell.exe
Token: 33	1092	powershell.exe
Token: 34	1092	powershell.exe
Token: 35	1092	powershell.exe
Token: 36	1092	powershell.exe
Token: SeShutdownPrivilege	3932	Medal.exe
Token: SeCreatePagefilePrivilege	3932	Medal.exe
Token: SeShutdownPrivilege	3932	Medal.exe
Token: SeCreatePagefilePrivilege	3932	Medal.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	Update.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2324	1256	MedalSetup.v776386636.exe	90
PID 2324 wrote to memory of 2836	2324	Update.exe	91
PID 2324 wrote to memory of 3932	2324	Update.exe	92
PID 3932 wrote to memory of 2240	3932	Medal.exe	93
PID 3932 wrote to memory of 1092	3932	Medal.exe	94
PID 3932 wrote to memory of 5776	3932	Medal.exe	95
PID 5776 wrote to memory of 944	5776	cmd.exe	98
PID 3932 wrote to memory of 2436	3932	Medal.exe	99
PID 2436 wrote to memory of 1320	2436	cmd.exe	101
PID 3932 wrote to memory of 4132	3932	Medal.exe	102
PID 3932 wrote to memory of 4324	3932	Medal.exe	104
PID 3932 wrote to memory of 4424	3932	Medal.exe	105
PID 3932 wrote to memory of 2532	3932	Medal.exe	107
PID 3932 wrote to memory of 4448	3932	Medal.exe	108
PID 3932 wrote to memory of 4448	3932	Medal.exe	108
PID 4424 wrote to memory of 4524	4424	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\MedalSetup.v776386636.exe
"C:\Users\Admin\AppData\Local\Temp\MedalSetup.v776386636.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\Squirrel.exe
    "C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:2836
- - C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\Medal.exe
    "C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\Medal.exe" --squirrel-install 2634.403.1
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\Medal.exe
      C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\Medal.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Medal /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Medal\Crashpad --url=https://sentry.medal.tv/api/1378175/minidump/?sentry_key=c8a362b2878242408b487aafa89be8a7 "--annotation=_companyName=Medal B.V." --annotation=_productName=Medal --annotation=_version=2634.403.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=40.1.0 --initial-client-data=0x488,0x48c,0x490,0x464,0x494,0x7ff71c9b76b4,0x7ff71c9b76c0,0x7ff71c9b76d0
      4⤵
      Executes dropped EXE
      PID:2240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "Get-CimInstance -ClassName Win32_VideoController | Format-List -Property Name, Description, Caption, AdapterRAM"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query HKCU\Software\Medal /v UUID"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5776
    - - C:\Windows\system32\reg.exe
        
        reg query HKCU\Software\Medal /v UUID
        5⤵
        Modifies registry key
        
        PID:944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg add HKCU\Software\Medal /v UUID /t REG_SZ /d 620f5c48-294c-41f3-9d3b-e490b5f03584 /f"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Medal /v UUID /t REG_SZ /d 620f5c48-294c-41f3-9d3b-e490b5f03584 /f
        5⤵
        Modifies registry key
        
        PID:1320
  - - C:\Windows\system32\fsutil.exe
      fsutil dirty query C:
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Medal\Update.exe
      C:\Users\Admin\AppData\Local\Medal\Update.exe --createShortcut=Medal.exe
      4⤵
      Executes dropped EXE
      PID:4324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4424
    - - C:\Windows\system32\reg.exe
        
        reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid
        5⤵
        Modifies registry key
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\Medal.exe
      "C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\Medal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2016,i,3627363236007978371,12533506009446235712,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2236 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:2532
  - - C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\Medal.exe
      "C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\Medal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2016,i,3627363236007978371,12533506009446235712,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2012 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Medal.exe

Path C:\Users\Admin\AppData\Local\Medal\Medal.exe
Size 458KB
SHA256 ef690d7f26afe6094dcf0c9fce887e7ef224b45690357b3127b9a935712b0430
MD5 33b88ba23b496ad48c119f445a879bb2
SHA1 054694ccd4702fe8d168e1318e4a74657a61a9e7
SHA512 d5d2c2c837b6987d717e10ef73768fe6892a0881d68525a1562305f882c217459199a6bd9049d8aaa7cc16cce4190cafd1febb4fd11421486b42453706995ad2
SSDEEP 6144:nPhyu7B9Hz8TJPm7/qJ0AOrSwAS3N5qADSQi5o+RQ3qL8dRtuoTWnN:PwMATJPv0AhS3NHm8DPWnN
TLSH
T117A4F89876A25473C5B40AB05BB0EFE8423A5FF33F0921967243366B7D7DB42E51B086
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\D3DCompiler_47.dll
Size 4.5MB
SHA256 2821ca3bcf58c90fd9c7109ede742dd6589fd378dbb51b1a676d252fcffe3fa9
MD5 08d1125e520120ec42a0985f72c25c2c
SHA1 b3098f04dfc16dac6b54cb352f5acb980a86a268
SHA512 7dbe6c3427c67e9c599a7aa392287b7c67318cc83c8b452c07bcac64786777ceb8a9ad63a86e881f6931450f3c8631f846c878714b964c6c0893c1f174299c94
SSDEEP 49152:SSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqf:9uktcrfNlTyj5byqSs
TLSH
T1BE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\chrome_100_percent.pak
Size 112KB
SHA256 cbe052e9bd36032cde9d0ad7496d611c6a3c98a130b960e1298d490254be1159
MD5 129f8cee761c5bb414b2270356177f6c
SHA1 0a10b55daf24c7f9fff1b22f853dd87a98433b7d
SHA512 33f4ceb0ed18b2172e2f6d203ccab2954dd900592b2e62ce4a1019ab9404889ebdcf462a2479f1847c01b2835473e83859c77816e83ef76ee133990be3d55eb4
SSDEEP 3072:DS4PisCv+/P9NebGz8LI1TwuLjQBHe7YAP18RVC2I:LYWFUbGz8LI1TnjQBQCrC
TLSH
T136B3D0D7B3B09D7DDA460BB783560170FCB31B2D06C2120A5A9AE479652BF88C8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\chrome_200_percent.pak
Size 182KB
SHA256 6593ba8ece63001a3fb77bd1d872566edeb26213a1be8e852dd956f6d0e2c93e
MD5 ed7b4e5eb15a086ce7e117a3228e3f15
SHA1 bb6debc27ed4e2f20149a17e36a24ef4482a96a7
SHA512 7278e0acdd8a1806bbdfd147d5439f7f849fbf95f1be1ffb741ea84cecad2557469e99f91cca66ce36349a9aa55d0107e34b9499b8fcb3e7fb3a8bbf84c1e911
SSDEEP 3072:CJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPoLjQBHe7YAP10uxR/TbIM0:7GQ+N6uSZQDQYakvyAkcjQBQNd4
TLSH
T1EB04F1D723B8AD3DD9570B73926610E0FE7A20291EB3110A5A9FD8397925E8CD9CD343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\dxcompiler.dll
Size 24.5MB
SHA256 40a41eec9d90fa1e348ed1b5d398a94aa6203b45a08126c1d3aad39941ab3225
MD5 217ee733215e738f2777970f852e8dc4
SHA1 29f4d1c1e605f4d1a5e3276be02f58ddbdc74aa3
SHA512 442bd7d44fd6eb0f6bb8894338322691f9052b0e48cc70cac2d28966f9808b8a2cd02d0ccaa7ad6c8a04e9e8a576e90f58716db1a83687dcbbc63c4d6e03daa6
SSDEEP 196608:Tsq7jjh1u1/1i9iJj24AD14c9TR8Z6GmfozCEJdXqaqR:Tsq7jjh1u1/Dxc14e8Z6GmfyFqa8
TLSH
T1234729122646D49DC059C879C7678B268A6C30E73FA7B8EBC0F451252B79EFC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\dxil.dll
Size 1.4MB
SHA256 681099c2c9adb30185438d89dbe5d909cef07f621a1dbc5a1919ccc653fe1b8f
MD5 d0b5b7ac910572bc96c2b023c43a2720
SHA1 02123d63f115428471b0a00d490bfe1d00267d6a
SHA512 f8eb1ed7ae1705baf1755c1eeb65f0da334cc5811dcac45cbb09533e4942bb2dda8fe599311036733e184ad61eb70fcdfa0ad19b070438132ba2ebf759e7127f
SSDEEP 24576:tY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kau:miTMYxy0Sy66Zh7Sh/cyvS5o
TLSH
T1CB657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\libegl.dll
Size 523KB
SHA256 f624c04a9d951f7e7a899699c7dc14a28b80e788c38bf2236b301162a20d7e05
MD5 34f09783c5f0a54a60586a2d9154c224
SHA1 0e130da6ab43aa7edd622de0dd35944ff498d860
SHA512 7af418b798b131e6f566d8a0d0ee373b58c8b62c509641dd2dfb801a316171dd9f32509268e92cecbba41450a51c573c216e8397df738f22bc08276543a68f12
SSDEEP 6144:8Q4VIVcVQMLMVwCtKpDaLnjSFeN+a+BAiLm4LiE0z0WhcEuvBLPdvtYPqQaq:8n0iCZjF+CymG0z0WhcEuvRltYD
TLSH
T186B48D15F3E84BA8D07AD0348A438642EB7574960F65F9DF02E052792F3BBE45A7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\libglesv2.dll
Size 7.7MB
SHA256 6f69703aa59f5c221817c55dbfc39d9ae1a6ad200e80e9cc58f7ae79b524d578
MD5 7df8b5e3cc8da859504bd9c4d85f0d48
SHA1 d746636c1e4c509f56b2c8f7b7e53558760ad646
SHA512 10349a261577c5375a73fd2c8d8ee4ffc8b3c394122f0e3583eeaa61c7d09522c40b58692c6d3579f21cf9ed1b4a0e2d253a96fceb77ad70e7f57b22a955553b
SSDEEP 49152:kupJ61ZvUdnnnzCwAOqBmONJAbLfkcO0VsWkgp9rnnG45/ifbKnNdCusheIYklbH:veCXaoJl9aWNd5JIBhhpJK1Ixe2l4g
TLSH
T141867B03F69680D9C05DE278875BA627FA34B8450724B7CF2A9453162F66FE0EB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\locales\en-US.pak
Size 537KB
SHA256 ef30389492cc2d31bc5c162056fe68c27a5d57b0a69f5f878562325f795c5185
MD5 0604e26677ebd9417c7de4c421f6254e
SHA1 ed023212b6951afcd80ece283d6ddc68b663e079
SHA512 8af64b75a40a6dca6ac5feef06ab5e8c898bf30b50be73e480df923461d42e2cc417bad5151eb957c9606540321e0dea48820b2c5009408e0420e1ebe1b01a29
SSDEEP 6144:K7dq1yx5HfUOQkbaqMP9qQ0BFfaYQDp9I3AjkgngP8/I2wf:K74k5HfCqM8Q0BkTjzwf
TLSH
T1BAC45C1FF744122A059352A2BF099562FF32D06CA35112663CBD812C3376B6AD3B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources.pak
Size 6.1MB
SHA256 ce5c35017fd7aa648fe44381711cbf42eff5f6923b11241a4789058dbc5b27aa
MD5 79762f4295600653dca20bbaffeed153
SHA1 85b8ab7d9e7fa663dca0babd1f72c79a1f39d99f
SHA512 13784fda38785e3dc23b118969478c61040e81e1271f6ca7d7536ae60872b1adc9f2a99e15fc17e5c4903046eee8508b686fa18092cfdbd1c0a29b79fbf18484
SSDEEP 98304:5vjQ8HDIPJ132R3lW4uKXegybAHltND8rwri0J/xUaAUXLPC1GP4kFbG:JB0BRulFzPtND8kri0JlAYz4kFi
TLSH
T1985633E1B7A06CAFC5484379D19542343A3ED95F2581739A188CB33CED6D91EEA4823F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\index.js
Size 984B
SHA256 7fe5245bc82f099828bfecf7f78e4c417d6a20fc97ccbf30ac17bff7396aeec9
MD5 ed1be6152752554b6a465aa75913a099
SHA1 b6b0a55907a09ea1772c7dddb9fa912e12f52f87
SHA512 f8b1ee59576fac44095deef9bd3d5c5a1b5901c2453d0378b96a40f77f52ae666585847af85888d8a8e2cd2a09745c16c28098b3f5c415f86a906ae275848e66
TLSH
T1EC1154C5A5FF6551AAB183AD302B02B9FA36832226A32361B86C97072F55650631383E
MD5 SHA1 SHA512 TLSH

Submit Download

main.min.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\main.min.js
Size 4.7MB
SHA256 b906857cc2d0fe6485d44820ac033b93cc20ee39d442fd9e37b042976461587b
MD5 393676637405dad47d6f15988e2b939b
SHA1 ce7c3d0b021752a7b5350eff0b32e63c021f3b30
SHA512 78de773f36c04cc57e89e490cf7ef66ed195060a798326746da3e3de074668625267c1474f7ffd228b836f62e49d40abec66784eb9e6931ddd562b5275db4df1
SSDEEP 98304:IEL+nZnSqhzyoAnPkqQv6M/A0DeuV21Bn:NQv6MdtVo
TLSH
T1D4365DD976E330224BA361B9955B5002B3389407740CC858FA9CCEEA2FD585D96B7FBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\index.js
Size 796B
SHA256 924564d5be26d59b9682c4263f68320e48dde7240bd2d1ad17ec305537429dd2
MD5 a15f5d41d74ff8472614c54d87841f64
SHA1 519557fda97020cb2a4c7aeffe7f8edf03e536d2
SHA512 89d799e4281f6906c46b1105b50bb0baf9d9b09adeaace3b48f8a4071f951350cda2ac56f8c47fef5fcdbc1a1d5a1ca139f7c10c547c066f533aef5e5968e0c9
TLSH
T1B9017590D5B5A5D930F852D1F96CF0C1B7978148FB0695C1A67CC7E3648B08C5B19FD2
MD5 SHA1 SHA512 TLSH

Submit Download

buffer-util.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\buffer-util.js
Size 2KB
SHA256 8b0a45739132f82e25ea13163780abf547ccfe989267f3eb7abb475beec92da3
MD5 8c25c9dd9f6e3773f89b9e32b7105c3d
SHA1 f7118209aa3e4032abdb8180519a3cad15f0de05
SHA512 bc2e6d02069d7841150e43cbfafc5992e3003906363ff38dbb2ad9c8d39af99fa47e1343ababad1f72d27e3e09e022b9cafa978a57539ab3da27eda4168596de
TLSH
T1D651144A2FE060760203F26711C75E8FA3748A05B657D945511D6F602FECA74DDF1ED8
MD5 SHA1 SHA512 TLSH

Submit Download

constants.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\constants.js
Size 503B
SHA256 391e823142b8b370e55a2fd32b022deaf03b8415c56000009674ebc86a0b4f86
MD5 22783d577f2ad3dfbad775128bcfad96
SHA1 b3726aae205316457c35cbbbc75b8dc73562e08b
SHA512 2103cfdaa7625d5a094426d0cfcce965f053a2934888db120a800c31322bdd5634f1988d66208c5431703fda6226954bc264fa5dddfc45cc81f5ce1ac2643b22
TLSH
T161F0592F1FD0B2BD9CB7500F5A6EBE45B8D15CA223CFF91550489EA8470C8401579684
MD5 SHA1 SHA512 TLSH

Submit Download

event-target.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\event-target.js
Size 7KB
SHA256 c45d3c6e12d170c860c0c3f1a050aa0f864d9806632b609a1e607d675aba128c
MD5 d02492ef6fdb35d8ad8af33f90c91fdb
SHA1 923aff1a440b1bb30658a2a3f9e3a9da6ceb0eb7
SHA512 47d8c788b7b57851e6967f9ee5a0d183800040e77f540720982e91cd992a03543f9014cbed590cdbf1c6c6a17f83e88aa3d797102db5aa6ae756e6bf4e0cdc53
SSDEEP 192:vcQQOMbplFo81yEPHNjAZvIAqishOoS6n/6LCcGxFa0cnrVSL:dMDtyEKvgiUPHi4
TLSH
T155E1DE492AF403F301B7A3BF770A7190D020D5EB622965E474ECDEF90F49AB496E2784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\extension.js
Size 6KB
SHA256 852564f0f6b460287043803eae732666fb5610f676874354fc89f06aa4e986ed
MD5 379b482fc8622cbf8731096e70734b3d
SHA1 af02e218b64fac9b65b54732ff593d62ae6bee5d
SHA512 6c991272627c0a452bd536c9e3604a9601d42f0f17aece0bd712df5c0fd5a2f3abc2bd70f025fa099092b7cf3946e2ade4c21e537720b8ac266196f8c813cbe8
SSDEEP 96:sKoor/fSpwCljhsZhk+FsqNB0GtPH+9xalu:sKC5BeZhkAxNyoPH+b4u
TLSH
T1E8D1019629DB22120A7F78B5DA0BE568D3780107720CAA44BD8C67893FD5E3583B5F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

limiter.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\limiter.js
Size 1KB
SHA256 e0469d4b83f6ba764b15f80e1766b75c136fbff68f048f4c050f0b1c7f065f69
MD5 7b8a8dc5be27a1bd1a39544cc28ae73e
SHA1 d56ca70e1a496b15e1cc90ac740679d7a6c37eab
SHA512 1c1731373a93c3d7f27dde4b6e06565d013ec7fdf6714ec3e1f5844752059a0790e4bc571f20301f45dc63a55e9129e304ecf3551791370c40152942caecd574
TLSH
T16111CE2606EE14E2D02321B58E6B6254E562110FB61FE8D97A3D13AC4F46F30E294D79
MD5 SHA1 SHA512 TLSH

Submit Download

permessage-deflate.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\permessage-deflate.js
Size 14KB
SHA256 02c31796f0132a335d4efe7b7adcebadbb69543a1ce65ae04aaccc3530e27ab9
MD5 607070f8184092407c7a63fac8c69f20
SHA1 9f9896dc0a4352671647ce41168fd790feea669e
SHA512 f9b361c89d6b73e72e3eeb4ff7ffdae3e98c9f3946d8c9af37b1a94812ec4fc3057e8bead1886d2532b38ad119eec6bff5a4075d2a7874a829a7e3ed09fe924e
SSDEEP 384:CxmZikcIjmNBu/OMiSOsbOk7OadYO7oFJt8:oiiDIaLZSOIOmOxOb
TLSH
T1266261591BFA026740E767E68FABA24AD330D01B352AD588395C53CE1FCDE34D399B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

receiver.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\receiver.js
Size 17KB
SHA256 4879edbf8e48d04d09783cf9c04b5e25f5a448247bb01279438ded2899747220
MD5 302d12ce5e6335659be9f6e231f351e9
SHA1 a2b39c4564bf12c6e1d34aadc126ed1ea56e41f7
SHA512 8523688eaa2a9771f49f9748acd86f66f40f92bd3f3916ec8e67b72837cb85e522a3f41dfb1be59f26400ef57dd7b20f5cf4a59e6eb06fafd4257581f0e44ef4
SSDEEP 384:/M9nii1yJZFf8xBnDXehQhYgRO09Mwn9T9ovb:/M9nsZFf8xBnDXehQhYgRO0hI
TLSH
T17A82F0061BF6116A4063B47A1FBBA51B6124601F390AE84C7D4C66EDAFCCB3488B5FF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sender.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\sender.js
Size 16KB
SHA256 d0791d30c3defd44dcabbddb879a901c757993fea2c00a7ffea01d53b23b4b77
MD5 7a315f1409590d624813f219d862ae11
SHA1 e094ebb398e8dd676f8f2f365064cc178ff12bf0
SHA512 e8dfad31c0f3deabeb3e26541e7b159ad5b52c5f697459c2d4b170126c2de46686964d3c112c03ae35e7f9cee7976377cc3113f01c39245d8916402d7d8883fd
SSDEEP 384:jDt8gyVX1U/cV7If/WbiwKLCibvlLf5fKm/JtBkvVX1U/mBmNJ8VX1U/Y8dL2VN9:jDt8NVX1URCiblLf5fKm/JtBkvVX1U/S
TLSH
T1217232191FEA126A0093B1A48EAF9057B330F22F7619D498784D7BD02F9CB7091E6FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\stream.js
Size 4KB
SHA256 a56fcb6e2b152097ee820b6f5410b1f71e59819b45d08d9f8bda588fe39070ec
MD5 06840a6e365bdb23c05dd958e4756473
SHA1 d3de11ef622c66ffc0ea4c2bdc114e85779d0db6
SHA512 89d9ef4ea0cc3ff80d7697229c2ef9a6c57d2308f3e0469cd94a1dbd2da2e0de1968839773f23c986efa6f91ec1ac3a960226f0427d9c0e0846b31ea6f0b2ee2
SSDEEP 96:/QWVMjxumJYNQ6gvRNYY/LDg5Ib0IxC6tIqO:oWVMNwgvb5zsqbk66qO
TLSH
T183812F4DE2BB126B6577B5ED4BDF83E53250C453112EEA40B58CCBA42F1E4340674EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

subprotocol.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\subprotocol.js
Size 1KB
SHA256 be3f6323d6f549568577dcba9004c1479d95c65a7abb0fe0c582875b9fac0b7c
MD5 942d99c9806b3423d8849530687d3d37
SHA1 45de2302a00451a68fb123f28faa3af105ce019f
SHA512 bbfa0495207e0222d726b45beff0189f8aa6351fe6068423213cbb6ee6661f2c869019a250ce81bfd13372a2d5ecd599b78f16e7950deacab78c5cec78291083
TLSH
T190311241A5E723894ABA3475C54BF991E3BD0206E14D8D483A4CD28B3FC59618FB5E81
MD5 SHA1 SHA512 TLSH

Submit Download

validation.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\validation.js
Size 3KB
SHA256 41ce8e83d0d434132e1704895fedb91f6703a701b42d91c80954ab29b2845593
MD5 fb87bfd1186d149f39b3a1d7948b9852
SHA1 2fb0c708af35d05a8206dd098d7b2d2515212333
SHA512 c0b96e19724df2d454bd1b21e8436b117429c03635f766fcaa561e0b76afbf681bb40e7e931ca954dfa0cff9108f52c8466cb702be88d1d424e7341219121e88
TLSH
T1B581BAC757D6212C0353C16D8A8A8C1B66ECD4B6622C59CFB84D3ED4DFA9560C7239CB
MD5 SHA1 SHA512 TLSH

Submit Download

websocket-server.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\websocket-server.js
Size 16KB
SHA256 29029a4d346800c792300df153df2007e9805d9d7b67b0883f9730b64f25b1c8
MD5 6ccc26822b7e96a71f7a15888ec1d076
SHA1 9e44cc257b331822dd9694801e507c6d74d23464
SHA512 72a60cd7f44ecea49890ea7fe27b50578e4296e4a142bdb000b8e33ad10bea1837d9c69b16fd383bec27b15da71cf3d9326e8aa19c7f805761c16629570b27b6
SSDEEP 384:6Dp3YNLX5NMpia3JUfWGdQT0DnbPEgQLDabWgD1sSZ5:6Dp3YV6p3J4dQTQEDL+fj
TLSH
T1CB72A945AAF623BE00F3E2D95A4BA451B338C1537306E495795C9FCA2FCF6B48261BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

websocket.js

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\lib\websocket.js
Size 36KB
SHA256 48fdb0f54c1f8ce580d3cfa2908fe7d96fe18f06f9d82306950441cb09b5db26
MD5 a3d873bc91b588b5ce78505549794716
SHA1 853865477225df4201343d9cf1c4583eaf8d228f
SHA512 1b1e83ccb53641b689ad38b45863733f386ce27d218d0a03ec72dd4ff498756537ef141636ec4327b9076962c7409a6f95fde5043fb645df45a2b94c9aa7239f
SSDEEP 768:774+FgTtkckOy1chyT+220GXNsdjg6N2GwGgiEOqkT8YwZkNercXd:7gTkT+220GXNsdjgCgZOqkT8YwO3
TLSH
T1F8F2A785EDFA13AA60B6E2B54B8F6485F330801B7316D5D8345CDBE86F4FA7042A5BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\node_modules\ws\package.json
Size 1KB
SHA256 584ce6e7516587ba249dc910b0c04e2753f6b3f451fc3a5bc324f7735bdacc71
MD5 fb5c34c5e2edffc3f31f4465740590aa
SHA1 98891dbb3b44c5734c567b72eba63c094e50117a
SHA512 314eab3555cc397a2ade5b627a38a4e99b9200b060fefeb7fb007fbc248efd836e682f9c4d65423d4c0835d323b5a31ffbf486b18257518e578bc2549ce1f85f
TLSH
T1C031FE76CC790EE30EE529A878A441527232485B5984FC0C7BD7431C4F4EAAF11FEA5D
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\resources\app\package.json
Size 9KB
SHA256 1e48c69abf6d090e0f34304f3b93fd326eb782754baba6ab594596a03c62438f
MD5 e31f8f6d13f5e4cd5c3ccce08ff12483
SHA1 7451850944a941eb33158ece3fd707e53cccb003
SHA512 7048a40dd6d9b573e5bbf6c52245aad28bfe9a48c982a58414284b41bca525fefa7618b0221a0b49fa05d240597075e196b1a78683e63c3067f0f40de64b35a9
SSDEEP 192:JcmTp5cJXN/ryosGosWOYTY/SkULnON5d/pFn0UdNsKa9ygVWEYoos0Vzg1tik:5+JNGosGosWOAn0dhFdd6Ka95WEHL
TLSH
T1CD12317BCD498CB30DB2021A7AB82569F06E530F929DC6CF3374435E0FB3A2A4559791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\squirrel.exe
Size 2.0MB
SHA256 9c9c39c36c3007491d19cfeb7ed3429d68e0a54a7cee919bbdc503471f89421b
MD5 4ecdc3370223e94f293e40e2bb801c2e
SHA1 a0799d388a33a6e167ddbf11bfbc4699fbb4854b
SHA512 4b955a3303e1b195cdd2e3a6bd79284029de12014a044ce13b11330177bcbf76cc6aa75f188f5cc29cb868ab889a56d962ffbf12b747f17bc9c85dbc5d02b158
SSDEEP 49152:wKf4kxKNMVup88THrE/HF3wfGHxF5v9+bp:ziTHrE/HF3wfoQ1
TLSH
T12EA55A01A7E88E3BD56E17B6A470269807F3DE973721F38B660971B92EB37109D02357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\v8_context_snapshot.bin
Size 696KB
SHA256 1df86ae706c6fc60bb6f4e60d76c5a3f56affa54e6b1442f51127bedc589d089
MD5 ac1ecab348d666e70d3bfe6877a43f99
SHA1 7e22faa7dd16b965c4af9e6b85b12a11d2060f19
SHA512 81bc684328821627718339eca626130380dad46c9c024df775d5356ca20a5fa9cc55b48f8e9d7ea244f065c86977c952a14c7dce29963f1c5afe1285bdf76d08
SSDEEP 6144:9af8tLrT5X3ukt+H92AqD9clxP2NyhaigNw69I3ndbkboE/UZ703yCTzrWD:9af8tL35X3usCN2NyI4NbkboE1rTzm
TLSH
T197E49761F71ACF26C6493A7D8DD657463930B2CE8E46E24B3406B33E78B96704D3662C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Medal\app-2634.403.1\vk_swiftshader.dll
Size 5.4MB
SHA256 9a8f8ea09999bcfafa52fa14ccaca9de9f03c0408826ee8d2b19ab266211e8c5
MD5 5ad9d62a58a966400c454bb7eb2a9b3d
SHA1 778e642fb021d167c6d2919f64f7b46c510afc52
SHA512 c71727aa0d01b89b6bfd1effe6de9d4e59f37d757173a6086e5f6dd879028ad265dfbfe861221adc2e0704a63cb2cec7badabc2a87dfe68d6ea8657df3cb42b7
SSDEEP 49152:3hqQRjgbS5A0V4NmoIb193Km3QIH6hvweSNerodqG5iBgP6zPPvT48unNHRVq45+:31gbID4lz8ZlwZswtwmdXnF
TLSH
T168463803F28681E9C06DE579875FA633B631F8850B2276DF56A00F192E66FE06B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 9d25526ed9e4467da0ae814e8adc9a889e6860c9ee34a7dc95f90ccab2dca406
MD5 58c557b87adcacafeb6034b42067638f
SHA1 59af5ad2cb6234b574b41ae0bf95ec8598bd555b
SHA512 663ed88080e7ff4c3f51559bda58ff372dc61a1027d76fd095d1a81eb11c4b66993affc4ba5f5ab50bf9e1c9592a2f976f98db15d8ed2041c108139366c54309
TLSH
T14CA012DD4D540024858203841440D91C9701A361A2C213C5490A47090D22341E3F020D
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 f227fb387354c36743d9bd9b64fecd7cea6cb26dca9e5090f0652187bfbc933c
MD5 c5fc191e938a531d5fbec1ca6ced97a8
SHA1 7583102ba521149b4468f304d4c218eb3d8c34d5
SHA512 f12c9b452998f80394283aa061062caf5bf4863ea60058dbf962f8164e9de9429c313ec44ab2d53fe6aa697614fe7568dbfa2ee0fd29e71bfb31ba5368d1dede
SSDEEP 24576:jKBgsOuZ27kxKNMVup8gZTHfTE/HF3wryXg6UDfbXuj4Gx/TbBxaMt5vedX5KZ+6:jKf4kxKNMVup88THrE/HF3wfGHxF5v9v
TLSH
T12A956A12A7E88F2FE56E27B6F070105907F3E5866372F78B660CA5B92E833644D11367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 5KB
SHA256 c4e353de9414b9af2c8b7e9eee24ad73fcdc9da2662dec9f0ec95ea6612f0602
MD5 871dad2aa61029fd759b25c73600eb73
SHA1 6e50dd13852c2ee4bdb97b92625b08028b3d20e4
SHA512 e5b9385522000aafa0a47f4ef6d07f9a62197a7cb94ae6f1cf70cf5c0e5ec5e886b5f4c838e9f57e8671d08d11887b70ca6754a030e89072ca97a9ac7516fb89
SSDEEP 96:fxf33Pf3YDyVp80hcTg25N3rHRomt4nnm1Ctpp70+nuS3jvHOe6XQpvpWf33Pf3n:5ng9zg25N72m6m1ap7nnFz/OhgZQnMe
TLSH
T112B16C7E84294530D4371134A7592DD7426F8EB2009637A9ACACFCD30A29B8E186CCE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 210KB
SHA256 b224df52e505c1f0ea3f7a3257e9bebfcc2bc6970ab69cd9feab3af43c1dab33
MD5 3568c98fce9ef20d3f794eadb7f5fdad
SHA1 3b6fc8ad3e1c7f437f347d3da697164f9b99fad8
SHA512 45198e0f81eb07adb96b2032ac0b137addbf0f07db2655cdc33f8ee907c9a0a60f8891265f967a40ffa2c8b0f6b3f8248af1997f1728610602d942e6f0b43e13
SSDEEP 3072:OX8S3N7VqAD3iP4i5obSRQ8+IN9NPynLDSL81rgIJtuYSAECNxQ/f:ZS3N5qADSQi5o+RQ3qL8dRtuog
TLSH
T1F524D09C26625477C6A40EF59BB0BFD8423A4FE33F09218471433566BD7EB07EA5B086
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Medal\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe59b3b6.TMP

Path C:\Users\Admin\AppData\Roaming\Medal\Preferences~RFe59b3b6.TMP
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1092-1726-0x000001CB43E80000-0x000001CB43E8A000-memory.dmp

Download

memory/1092-1739-0x000001CB44010000-0x000001CB44034000-memory.dmp

Download

memory/1092-1737-0x000001CB44010000-0x000001CB4403A000-memory.dmp

Download

memory/1092-1676-0x000001CB43AE0000-0x000001CB43B02000-memory.dmp

Download

memory/1092-1688-0x000001CB43DC0000-0x000001CB43E72000-memory.dmp

Download

memory/1092-1687-0x000001CB43DA0000-0x000001CB43DBE000-memory.dmp

Download

memory/2324-1069-0x00000000219C0000-0x00000000219FE000-memory.dmp

Download

memory/2324-1072-0x0000000021990000-0x000000002199E000-memory.dmp

Download

memory/2324-11-0x0000000000CA0000-0x0000000000E76000-memory.dmp

Download

memory/2836-1644-0x0000000000E90000-0x000000000109A000-memory.dmp

Download

memory/4324-1730-0x0000000003020000-0x0000000003040000-memory.dmp

Download