Analysis

  • max time kernel
    92s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2024, 13:29

General

  • Target

    MedalSetup.MjI2MDYxMjE5LDEsbm9yZWY=.exe

  • Size

    137.8MB

  • MD5

    98b736fc46d30ee201f684dd159ab9d9

  • SHA1

    c835e0e3de2feb2ef38290786087abb33311e673

  • SHA256

    13cd8411e4cc767181a62da50d8b1b6cf1506c596bc275374a14265195b2143b

  • SHA512

    cd26ffaceaba940f6047e6411c6534b61c455b22970252d37eebf55c80e3b0a741b986f2874784a34a2b841de4b501577be560ce7b197412089792854bf5b85b

  • SSDEEP

    3145728:uTPGQXtt6Mwtl8DWR33C1aoOHmAVsfYslu4J8Z1OoU7DpvW:uCwYMwTjloODJsu5FqNvW

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MedalSetup.MjI2MDYxMjE5LDEsbm9yZWY=.exe
    "C:\Users\Admin\AppData\Local\Temp\MedalSetup.MjI2MDYxMjE5LDEsbm9yZWY=.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3660
    • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5072
      • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Squirrel.exe
        "C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        3⤵
        • Executes dropped EXE
        PID:3968
      • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Medal.exe
        "C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Medal.exe" --squirrel-install 4.2378.0
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:384
        • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Medal.exe
          C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Medal.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Medal /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Medal\Crashpad --url=https://f.a.k/e --annotation=_productName=Medal --annotation=_version=4.2378.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=22.3.27 --initial-client-data=0x508,0x514,0x518,0x4e0,0x51c,0x7ff63aa71898,0x7ff63aa718a8,0x7ff63aa718b8
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3284
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1848
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic path win32_VideoController
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2856
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2968
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic CsProduct Get UUID
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3724
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\Windows\system32\reg.exe
            reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid
            5⤵
            • Modifies registry key
            PID:432
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4228
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic path win32_VideoController
            5⤵
              PID:1052
          • C:\Users\Admin\AppData\Local\Medal\Update.exe
            C:\Users\Admin\AppData\Local\Medal\Update.exe --createShortcut=Medal.exe
            4⤵
            • Executes dropped EXE
            PID:2716
          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Medal.exe
            "C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Medal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=2036,i,9196610571524264587,9503335970829697244,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4784
          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Medal.exe
            "C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Medal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2116 --field-trial-handle=2036,i,9196610571524264587,9503335970829697244,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4844

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\Medal.exe

            Filesize

            150.4MB

            MD5

            36f4fecf0ae0e64d7e96a8e2654acc60

            SHA1

            9ddca82682f8edb3362beafff15c4f975c0c1d47

            SHA256

            c8c7ef2267391bb3498e27454bd5ec277672a47d63096d9e33e124b6235bb58d

            SHA512

            94b60d2c6c8767bdbd2a4cf997ccf3ffc690419453543194b363c15695934675ff15ed7686ac77c53602ecfed32fe6431eb55b5bd2a42202597df92223de449b

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\chrome_100_percent.pak

            Filesize

            126KB

            MD5

            d31f3439e2a3f7bee4ddd26f46a2b83f

            SHA1

            c5a26f86eb119ae364c5bf707bebed7e871fc214

            SHA256

            9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e

            SHA512

            aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\chrome_200_percent.pak

            Filesize

            175KB

            MD5

            5604b67e3f03ab2741f910a250c91137

            SHA1

            a4bb15ac7914c22575f1051a29c448f215fe027f

            SHA256

            1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c

            SHA512

            5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\ffmpeg.dll

            Filesize

            2.6MB

            MD5

            ee8851a16185d4a89cbb050f41850bf6

            SHA1

            249cf372165a99f83f08586b2da048da6a100a5c

            SHA256

            ff58a1a30d30d178f35bed269d4536b835f8ad07ddc791d3d5bd8652b8f0f266

            SHA512

            85546e191d183b4576fcc91408f2f1f285b5eab9a077cb6cc93315b4d798b016e3d45707a1e6171fa49cd5e0c55c4586d60c65d800d1736a7d3b6b630e26ebc1

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\icudtl.dat

            Filesize

            10.0MB

            MD5

            76bef9b8bb32e1e54fe1054c97b84a10

            SHA1

            05dfea2a3afeda799ab01bb7fbce628cacd596f4

            SHA256

            97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3

            SHA512

            7330df8129e7a0b7b3655498b2593321595ec29445ea193c8f473c593590f5701eb7125ff6e5cde970c54765f9565fa51c2c54af6e2127f582ab45efa7a3a0f6

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\locales\en-US.pak

            Filesize

            313KB

            MD5

            3f6f4b2c2f24e3893882cdaa1ccfe1a3

            SHA1

            b021cca30e774e0b91ee21b5beb030fea646098f

            SHA256

            bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f

            SHA512

            bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources.pak

            Filesize

            5.1MB

            MD5

            f5ab76d2b17459b5288b6269b0925890

            SHA1

            75be4046f33919340014a88815f415beb454a641

            SHA256

            4f29587bcd952de1dbc0b98df0aa506bd9fcf447e6a7258c5eb7e9eb780e6d6c

            SHA512

            6ec6a08418743adb5e20218b73169be4f45f5458592219497c3718e620e37871876788937418f1341e0023c1137f9cac715e6bb941f4690febdda993b072feab

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\index.js

            Filesize

            386B

            MD5

            5e2fbb9d655e0dd204e8d211ec1b4d0c

            SHA1

            440dc879e7fb836d97a5f5a40f016bbaa1b7f588

            SHA256

            8debe05417ec5d5e42661e2697a8d0db3ba30fa9bd4ac70c62c992ec01527bf9

            SHA512

            d6445a850642c562aa6affe907580fbf5b4faf70c51ad7b12613120a27ce1d6ee049571a709334fc588ff45c32ee918836bbae2188d4394a94c5810265139b2f

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\main.min.js

            Filesize

            6.3MB

            MD5

            f3685735e0d27d4dfbc0e4e86769d4ea

            SHA1

            61944c564aa7c0b60812ef9d26e6114ac608f83d

            SHA256

            8c1a4470a25dba99f997a7d9de66afedf67f3312d419b15f4316f7d921ce76cb

            SHA512

            e60a6ad57ea46251c4710e3611b2bbf9b440464b0060e41735171c51e14a0a988c482c652cbf527722773b3b133e92da24534a47f7dd0d8408d8f20d8976841c

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\@electron\universal\node_modules\fs-extra\LICENSE

            Filesize

            1KB

            MD5

            ea817882455c03503f7d014a8f54f095

            SHA1

            dd164bc611bca7ba8ead40ec4c2851081e5a16b9

            SHA256

            1e76029602ae9b21cc4e612db2496d92febed882ba13ba745f8b3309e85f9d39

            SHA512

            0ea343d0e696ba27877dc0611766c526aa73f6e7af46df5a0f83840dc4c7851fb5837b7f6bda8a014302bf877fe3b4b3e392b943cefb3af979e8afc67559a5ff

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\@electron\universal\node_modules\fs-extra\lib\output\index.js

            Filesize

            947B

            MD5

            b0adfc74c8e51ce2ab659bfc13752ed3

            SHA1

            1b0879db53a00bbfeddcfdc0c190901387bab7bd

            SHA256

            a27d1a72ed1ecddffc57e70187a4b72467ed0dd34092b7e3d2817b9f4359ab5d

            SHA512

            4bd96fa626592e856431c3da18f7f2c5262fcf7f8fc95a4fa8b3ecd6bd7f53e82ee27d3255711df0addaaaa3fc7ba5e11104dd448f90f490e5517eabc1cdad42

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\@electron\universal\node_modules\fs-extra\lib\path-exists\index.js

            Filesize

            263B

            MD5

            dfb2813673ea5279a9aa7305e5fe33f3

            SHA1

            6e6491c1ab3389433d1b39a33b3ac8760649a2c8

            SHA256

            5ce096c95daec0259817248921b39a9e0df4d342db171138ccb62440cc7a0cbe

            SHA512

            53d93b66ed4a2eca23046e6f2b08fcbe4cde40a2b841ab38db838ac75b0882947371024cb74ae43d2c9a2e095e2457e2207979c45f07d46e6e2b5f99efcfc794

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\@lwahonen\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h

            Filesize

            4KB

            MD5

            4ef9928ec21c398681ed3357aa400c48

            SHA1

            5bafcdf7c4ff860ce7f94c5260159e7bf063243b

            SHA256

            ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0

            SHA512

            c0f5f26b249cf3ca72b2d334008a7ab8b7332f286e57edf7c700b5c4a80960dbce14e3db940829134a3bc593a087f56b41afb757daf3f03e32611ab1172c1f6d

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\@lwahonen\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h

            Filesize

            13KB

            MD5

            4c8fce7c4f0bee30b8f03d94fba5b66c

            SHA1

            4eb6b34a1547e2da9b1a0daa9c9f7a32569a03e5

            SHA256

            bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466

            SHA512

            0f077d7c2a9801eab3134d4c56793f64fc1c8434e8eabe9c749d0f7d0d875b1750ad0f32873b49778bbb7b5864c280c4546fd72775ad0ec49eb091ec26ee3848

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\async\dist\async.js

            Filesize

            219KB

            MD5

            8e1598d40fb098345d3a535b64283ded

            SHA1

            69a84082a52a16bb9d3842729265d6d852687631

            SHA256

            df034df3912bed7ddc43844d7318c6aa82fbb90046053e8b97fbe1d69825d153

            SHA512

            5c50096857817ab1799891876f1b84d4ed245cd9a7488e23cbf6e69e514eee0220b1c00b4c262ffa8ae8ae81421c11496f3b1459d590b4c646c1aec1736aa828

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\async\package.json

            Filesize

            2KB

            MD5

            f61c8b5330d5b02b636e3bc1f919b38d

            SHA1

            435a1425e76245b3817da540d9184b6392ecda71

            SHA256

            e77ef78b8bb1e7e441778f069a7b1e5d394ac1b5f1b06e6eecce9bcb89a148d7

            SHA512

            49cc14e13a4772ebebd4358437d94f704198014f2fea96b87d3178c80478067791d4b4462f54c34cb5eee1c3bc54457e5eda9f97e220f98b0d2523a5c8c68bdd

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\b4a\index.js

            Filesize

            3KB

            MD5

            b792856285e9760aac0ca447b4cdad32

            SHA1

            c3f23229d5855aa849565a6f4dee345b4471e53e

            SHA256

            7bb04f74fe05865a5382a76b07cf11cf34f53a18d7e44679a70e3ad33baa4d64

            SHA512

            a147f23a7d0104812ec98d07604c96c47359aecef4873a912b87823737ed8fa4898e7574152815317c7c30c72f5857913453abc0616de20b998c151034bf818e

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\b4a\package.json

            Filesize

            731B

            MD5

            0d8a61020dfcd3eacd3203aac69c4758

            SHA1

            9aaf999e183e6a5a65bc8d7ac4bea3f99be250e3

            SHA256

            eb9b447bd66da6845b8c637526f65f9c792bcf8c242e9c1ce4f78f3b474b2445

            SHA512

            2c0addcbd2b57d28eb13ac9faa64aa9b741c4797e97afffe12341d803aa34403fcee226604bf3407246349f8bcd21faf76198b8c2a609ec682ee93c98d258d08

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\bindings\bindings.js

            Filesize

            5KB

            MD5

            13c05ea1a2f638b707aa56eea958810c

            SHA1

            c93878e75a9f0545f73aa8d6fba3a761c4ceda36

            SHA256

            8e32a0d37f20bd6f7d5bdbf99d041aa27be47cbbe5172ac13ebf7380a10b3bf6

            SHA512

            f356619fa479c72086138eed34fbdcf501bb6f263249e5cf3b1069b2d6c120afc32d9b2ee89d9a41b2f516251c8bbf5d9913e78105961a989e136ac03146657f

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\bindings\package.json

            Filesize

            660B

            MD5

            17005447df8440e0e386849b8fa2b682

            SHA1

            14bbbadeb1307b1f711ee10093d5b46a7889677c

            SHA256

            a87721fe406e1f1798fef44d697b46ea1efe346fda118010334713346ee4207c

            SHA512

            a61aa9260b34479feb762f81f23ec26104d311fee81bb299efa00fc7091d3ae7f10047f6d91bd3bcfec7152b754c9fc6fe97ac280b3c00abc945a25ef387105d

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\blake2b-wasm\blake2b.js

            Filesize

            11KB

            MD5

            6d4fdddbe0e3df6ede11846ac2d9f104

            SHA1

            16ed563b7e5eb247279479de76bea594fab392f0

            SHA256

            ab8919c1546bd3015afb834e6f0948a7c53121be4f4107ce2a3f4eb31c3e77e9

            SHA512

            f895785e1143a0952c033db6317f9f7d1dfd8c220827019d4857f0c0a6fc67f08fb89ce2aa8fc45d601ee1afc40950c91de2532fc76fefda1c461fa25229c1f9

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\blake2b-wasm\index.js

            Filesize

            4KB

            MD5

            b1c4d73faad73d98b01810cde1eb52fb

            SHA1

            67c75686ab7cbee0ac60c3a7f8a5a9ae083dc0ce

            SHA256

            0ab2389048116330718b012ce387aa693e3f318e9cc9b697d32a96d65bef25bd

            SHA512

            bb5440c3bc7f2f309b1aa237015b493e01ebf53c595413225658feed63e48d42851064615a45323f3c13c7f55c7193f5c73c2f9c1f196406e474813fc2feab4d

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\blake2b-wasm\package.json

            Filesize

            782B

            MD5

            85f6234e8249e84f2a2361d5142707a3

            SHA1

            d3714b3f9fa05401342b89d5c9f9d47f9bdcd7ef

            SHA256

            5bda19aefb010a8fccff1fc5dce0e9d3ff75ae1921e584d1becb4c371b3b4541

            SHA512

            e6919601c8dd1f7dbbe487c42ec441411338cf7fcf3a2da0a4f7f91ed1d963d2db7e8a00ec4a4bbde5be8323db1fab55b44b364fc8684c710a041148c99b1e73

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\blake2b\index.js

            Filesize

            9KB

            MD5

            350e95a4d11b533abbd5d4414d38005f

            SHA1

            37f2bb772cc953169bbfc13087b13ba6952ed8b3

            SHA256

            89d35ca4687b8ad3bd659b1a39f44a8a4a393ac977be5af1e1ce32116c25c064

            SHA512

            8e9648cedceb87e36e915e050329d8ce246bfba0ac18f9d491efb0160e7e89defa7a4a33301def1dd4a2b72bf8b1ea6c64cf03dafb90c615f1e23d5d016e0863

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\blake2b\package.json

            Filesize

            742B

            MD5

            88595359281788f64142b0938af3f9db

            SHA1

            d35800917d86c3d104b9142926e9daa2ba4bf3dc

            SHA256

            47bcf83fa22df55efb1759c46153bc6e994036c2146d5a0de3867953a603f870

            SHA512

            a2b8cfc39020dce3384ecccb149df4092905e8ff77c14c93c6162eb35788c11b3141f2dc1382dbead2e0bbcc7f0970bc0e1af97b4e9795e2e0193f9fef4f7ef4

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\debug\node_modules\ms\index.js

            Filesize

            2KB

            MD5

            fddcc2097091479666d0865c176d6615

            SHA1

            55f9b3a7d4cfbf68b19ccd0d698aa86483dd4694

            SHA256

            55986972f5f3c9446f876c576e1cd30fd4f04cd26527efbb5ad834637c740e4c

            SHA512

            252644169a9398527927b69a2f19c6578bd62dcd180b94984d991939f53bf4e77ca687e840db42f7dba3b37124a5e3f3eda83535e75491bbe6ca440a7149913f

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\debug\node_modules\ms\package.json

            Filesize

            705B

            MD5

            b3ea7267a23f72028e774742792b114a

            SHA1

            fe112804e727b4f3489e9a52900349d0a4ed302c

            SHA256

            3708fd273bf5b1e91c72d88143f48ad962adcc10b99250a4a203d13804f37757

            SHA512

            01975d65bc491d0b39435d793a62bcdba6b5edf4fb886de0e48a8a393e26fdf31bdfb4f91dd7e10ba69a1e62ed091d5ea04f9f8bf57d784c3491a5c5c8472988

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\debug\package.json

            Filesize

            1KB

            MD5

            2630a1ac039c8970c8fb0daf0f2f03c4

            SHA1

            ed6fe3dcf77a4c2ddadde904c5b1fc47cf9893c7

            SHA256

            754ba4f352a9b983fbbf93cfffe015d29bc789a08eb05815270abf50902697fb

            SHA512

            a017d21a1ecb159065bc32b94b38de03b38c10448b85f88bfe1498b144320884d612a868b9db192d6acf041f88da415f953d9dd8541ee29e4053e2463dd54791

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\debug\src\common.js

            Filesize

            6KB

            MD5

            28e94a3cc7d081498bea5ced383038f6

            SHA1

            c9707394c09387b56864a8865158d29fd307774a

            SHA256

            c65bff44c189188e0c45afdbd9b02c427ff5c6e54b94da53c102fbb7a53f0e37

            SHA512

            5775d4c9b823dc9514488a28f2bfcba990a13defdfc5992e1ffec915ca5e6ec2ba87bddb1cb7f4b772345a14b4041f98a74f7bcc9d9be2a3371e3002c33bbebc

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\debug\src\index.js

            Filesize

            314B

            MD5

            d6c53f5a0dd8f256d91210ad530a2f3e

            SHA1

            0f4ce3b10eff761f099ac75593f7e05b149ae695

            SHA256

            aa127ff1752b7d9c7415c5c7bb6994d9aa722b81bcbcab4bd48316b013d23bf3

            SHA512

            4faa874d9d862ffc921528742c4f1fe8a9b22a358760f6e93fcef138523575329a801ce9659ed8e96b02b73e581b3e99d91973e22981b358ffb5e43103a536c2

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\debug\src\node.js

            Filesize

            4KB

            MD5

            6e63fda079262f01e14f03bdf77146c0

            SHA1

            481608e3c95722f3a474336e5b777a6a521e76f9

            SHA256

            f237adcb52849de7c128f57e0468b52353c529a6c8341810477c0e7144359559

            SHA512

            3017b4717118f56fac106dcaa046aecf3cc63c37e64f49838e5379a13583c293f39ec5ace48fb2dabeac6af4a967f96219812733ead6f36c3f5c8d132d795900

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\electron-deeplink\dist\index.js

            Filesize

            7KB

            MD5

            d359d8698706d059e14b6f3eeedced8c

            SHA1

            9acb5276a78ed09acf81a62e1db439217aff85cf

            SHA256

            6c693e5ca23e904436e4bf6e68901147d319fd7132b2bcff4dd061615bb8a773

            SHA512

            f44a7196ad9d4f44085966ac6724f48d00566189136d08a9b13b4ac3cc7e6d1addf2e854098fb4c2ec94c28e3f48168f82b0d1134d0066237dd5fba91c35ccfd

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\electron-deeplink\dist\stub.js

            Filesize

            156B

            MD5

            62063cc3b8565061daaddf496dd15731

            SHA1

            206166851431982536333b4a1b9c31f9e5111295

            SHA256

            3f39ca63ca2f696207da3702df9a4df21e980a13f0e77528340730e2bf315fd6

            SHA512

            a6006c18cdf95cf641e54e10c76ff6c7ae47d881435ca54847e2b687fec2a9a129a2e2e3ca600557a328b34c22c54cfd7a6db4865af0f122c6cb5963e65c66e5

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\electron-deeplink\dist\templates.js

            Filesize

            458B

            MD5

            790b7b8bf5ed00feffce05aac1c79492

            SHA1

            5ac0afae48c626cc6474268c725342039e5e5ef0

            SHA256

            6bd01e7f8ea390760ae26ae469f6627dd7a9447360b477bba6911b76cb0e921f

            SHA512

            2522716477010a2ba3df3b1faa69fd8bb36cad02f6a43f95b7bbb75a49f516e6c2619e1dab8e1b85c888a2385b3435ffa95f9cda95e0c4dcdcb467cadbd515f5

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\electron-deeplink\package.json

            Filesize

            1KB

            MD5

            16fd5b35f0cbaed2b0b719e69f9f5a4b

            SHA1

            7b82df17cfdfcdfd8f8d4ff02502f1d7a8b964b4

            SHA256

            9fa3547f74427c8e7b20cd51a27f58d4a97a465f919177a7fb177143624e0e2c

            SHA512

            a19b574a3009dd7cf823dcfaf84790a60bec7b743211045cccaa3970923fc403af3c80d801d8a706cde599afe79317f99c98f429abefaad4583e6e181d55a5ed

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\file-uri-to-path\index.js

            Filesize

            1KB

            MD5

            d98f7c699c54e0e90f408a44feb3188b

            SHA1

            0ffd660201ce0749053d108c53e5606b9da158d6

            SHA256

            e62293e871bdd5a7449ff3c7956c9536ec1d2ea7369461de77322b5256bb93e7

            SHA512

            7389081fbf3b16f0ad99f556337679be895e04930e36bfc8f99720e013f28b68bdd4579f11eb41dd4cc7a64a36ec26a6e6539d42d5888696f71e7d2d9c8784dc

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\file-uri-to-path\package.json

            Filesize

            717B

            MD5

            65f30030f0e7b2eff552eaabd8bb1fe1

            SHA1

            5dee8a540c467ffbf9025481180c77a06a9f46f2

            SHA256

            71eb1e24bb9694f89c613fa0aa307f977dd43f41d11794c7b48fabf6c55f66b0

            SHA512

            763c372773f093de60fdbe0bdd5d0b6362882e22eaebed51f70ea50fa3087417b5c517ea9ea057b56d40f019cea042a6e8c387356da1b9b9d39c2a5f16e7b5d4

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\lodash\lodash.js

            Filesize

            531KB

            MD5

            bbb588cc4360df5d317ebff5f5c1ac9c

            SHA1

            03d60d1510d24a952ff370b77035b031a87c4158

            SHA256

            4c04561befdf653aef017a42ac5addf68ea943cdfca6bdee5ce04e04e8139f54

            SHA512

            da2c021e3ba3f8f99d0b2bdbf3cacc39c87451c290c551e2fe0b009a5d5f3777a0f3620368efdc773cde5d7e221765732087acee9383135fc6d2db37401c2c94

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\lodash\package.json

            Filesize

            578B

            MD5

            188f386c15507c982c3e0d5a2db5b60d

            SHA1

            2c1ec9f730323c72f6f76e73f48b24902cc853c2

            SHA256

            8e41b07c744a0de0d2c1c23ed41418ecb0849abb56395d28802e601b4730d7c2

            SHA512

            a9a582ec1711e2dd19d80b43288821709641e310a44657d6dfe0b4b98644a33f6c9720e89a17516cbafa38518bf71653402b1fede5b2cf18dfe9859ed3973e5f

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\ms\index.js

            Filesize

            2KB

            MD5

            83c46187ed7b1e33a178f4c531c4ea81

            SHA1

            ea869663486f513cc4d1ca8312ed52a165c417fa

            SHA256

            e5f0b6a946a9b2b356a28557728410717df54ea2f599edb619f9839df6b7b0e9

            SHA512

            51b45089a53a23c12e28eb889396e2fa71b95085baa5ac34d71ffb625131bf2fec3ae98efeae537656e20ea257f44e089bcebc9ad54cf672cde852102e43e153

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\ms\package.json

            Filesize

            732B

            MD5

            a682078f64a677ddad1f50307a14b678

            SHA1

            c290eb97736177176d071da4ac855ab995685c97

            SHA256

            1a6b4d9739790c0b94ab96c8cc0507e281c164c311ff4fbf5e57fb8d26290b40

            SHA512

            9e16c5689b57275f4ed624c6954f12299706e2372a60f6173421800da5edf9ed52e52fd2b0798f826cddbade6ca19a6e6a996960c6697cc2da0ddecb36409520

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\nanoassert\index.js

            Filesize

            438B

            MD5

            44d45c7081a567a4d0cb4bbb36bf6be6

            SHA1

            69a7954eab536502b052557d5911acb9de503dad

            SHA256

            5a3c8dce33093172d9cb3d6bdd34e464d17a1da175a8f8b74f0c0d22dde94fbb

            SHA512

            0c3195a63b389bab6612e3824a65a5cacc2852aa2f8b272e34717be4608197bc1f9b4529879a13fa9567d0ae9846916dd645349b9797418f88e7ce7bc5d4e504

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\nanoassert\package.json

            Filesize

            647B

            MD5

            de6935b833716ef4d703b58e188ace78

            SHA1

            01cb598615db0cb08979b3ff1e4324d047eb1fa0

            SHA256

            2152421c559e2aeb7c002ecfeac306340d23cf3783446cea607a284658df30bd

            SHA512

            b134877eb15c2fa70a5e0549c8a736e8bb8ff84426cac51ed581f707d38c75c110f96c233825409a3948a6943fb1c26cc25617092b40645e68073d6d58f0ee65

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\node-gyp-build\index.js

            Filesize

            245B

            MD5

            f1d2cfebcfeb0bbebdc649f14c890cd6

            SHA1

            94a1d57b67c83c95d48d4fcde53942f012518d42

            SHA256

            fc780fe9c792729536e92b506ea20d642e9135ba2f0891c04e3a7965bc52c524

            SHA512

            8c2302557596fc99dcb48a68fac45128ca1c4676be33bcd47505b57b0150c38895462f48148e48d0205bd0d78a4c972d81b811d1085f8da6f78f18c2e73a0dfd

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\node-gyp-build\node-gyp-build.js

            Filesize

            5KB

            MD5

            67711547b1766f72c279f23cb8e6cfeb

            SHA1

            2b404eb9de9b81bc5a758a18244d66e497ec06e6

            SHA256

            7f1cb3728c432ce4f796f7d70fa44d17383811e4028cd3ad35b340599cf05f61

            SHA512

            16ad783d56a6477e141a0b0479f0f87c63dd571996490692fbed8b8ee422d33a1625f5a4aaafd7e29fbc45e71ca73c8c85cedad961abec39f7131f428381708c

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\node-gyp-build\package.json

            Filesize

            772B

            MD5

            bc1654a40e474095d945850841a17ecc

            SHA1

            ee2b067153f014a2616eae1a1fb1cd1f763b5ec8

            SHA256

            1e44359c41302af8cf600363c7346d2011edb7125cd05af8114aff0f780eb889

            SHA512

            2191604f3073af1798dd6fe460056aa3d75dcce02b24e331c112bcfd5e8630654f8a9dd3052174ccb1ef9ea770b2884f195e6b30b484f7741b7c7fc216db5109

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\tr46\index.js

            Filesize

            7KB

            MD5

            7d598c8605e26cafe489544f1730d380

            SHA1

            02c41eea7eb4ce2d32b7faeb4229edaa28b9d8e4

            SHA256

            8194f9425ce9ab06ea9aebcd64a85ec064d95d61bb349f8f1c98762ad256638e

            SHA512

            f79b6e635786bb4b38f80562d862a6a2c908ea691b3fc42712aae82591c735acd02d8fd79ccf37468e58f865bba28f9be0d92182b30c8e4b4ef7261bb57f213d

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\tr46\lib\mappingTable.json

            Filesize

            253KB

            MD5

            26c6da7a34c8a051a60b3592287d3fea

            SHA1

            6e09dfd1d4d65675bba0a9bb69e0bd6393f0d5da

            SHA256

            b6b39724dca9011113a08d9d6910204062b58169e98952acdfbd19bf2c31bbff

            SHA512

            8ad552c64f53303c00f2a56c1fdc2d6c644b12aa993c181d5f4847fb4613701b3d03d2a4f8e347e1d755999681585ae3081e865ae54f21340c826196c2af83d4

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\node_modules\tr46\package.json

            Filesize

            732B

            MD5

            36ce158498fb4f35c9a42edb60665bbe

            SHA1

            49c76b0a075effa9325c17f55c4d6472ddf3c7a9

            SHA256

            615087f58ee138fd35c2b414c355b72e36e5919725b8aecc1c34f6a5585b9779

            SHA512

            676215940610329d35feef0674d9dc61a9ab7c265d6eedca582e13003acd8b9d8b4894c86e79eaa85e97266682dbbe9637826b99f0b9afa56dbcf9ad077a1a55

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\package.json

            Filesize

            10KB

            MD5

            9bdfdca3e22b43f399180dc40f053fdb

            SHA1

            1533e72ca0202b900b90e209c4385affd458962f

            SHA256

            b33596e8a1f8875749690db291c8990b34cdfc4a4ae4196023b77a2a3c24117f

            SHA512

            b76997231495b1cd07b8d4e992602c04a10f29d52ee5feda863097b7985d5a97a572ea32924749f8c0a5d5ff2a1581a72516552911c26e592d6bb7b677fceeb8

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\resources\app\version.json

            Filesize

            20B

            MD5

            21c428fea6bd57296e3d92711ca7eb0d

            SHA1

            ec301b512cfe223b839d708e5098fcd57f6155ef

            SHA256

            91a2b97d5ee0dc5f526bb03879c10e301699c5ae4db9cb744489050abf8b1b7d

            SHA512

            de0d88c77a7a6a0994cf5625f031d94bd1dcf6bc2eacc76f8ff36a762f872f271fd20bb5c062308bc39ed67c7f68668144974aa09b86b28fb3df6cbec64ed63d

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\squirrel.exe

            Filesize

            2.0MB

            MD5

            de69057f909c088b393d2084b7797b50

            SHA1

            7fc6b978d405b752584485840b88f785df06af37

            SHA256

            e9a3a9d5dcc3644a043354164a6d736260b9417dad144cba7264bdbd4f988488

            SHA512

            059146702f4903bbcb434c42ced3b57ad636fb38a8665c7956824d08356c819413027bdf6e4a829555f1c354568c01028a8104388e3cc55a254042663cff2b60

          • C:\Users\Admin\AppData\Local\Medal\app-4.2378.0\v8_context_snapshot.bin

            Filesize

            471KB

            MD5

            6503b392ac5c25ff020189fa38fbaecb

            SHA1

            50fb4f7b765ac2b0da07f3759752dbc9d6d9867b

            SHA256

            add78f3f85f0b173cbe917871821f74c5afe0a6562462762b181180d16df4470

            SHA512

            9c12fff1686845a2c0b43d35a8572f97e950f232f1ce5690fd1212f48c171edbcc5d725754f10a66599b0823ac0c995c7212e263b7e02ea0ed9f2d2b937fa760

          • C:\Users\Admin\AppData\Local\SquirrelTemp\Medal-4.2378.0-full.nupkg

            Filesize

            137.0MB

            MD5

            1f1afe3eaa19389e2923984d2e575218

            SHA1

            348302752f6869aa2b9b67e891847d8939c18199

            SHA256

            71f1bd8cf6b61d7b11a59e0abcc28583e8c092b6b6ef80b36f438ba9caab302f

            SHA512

            5622fc962efa3e14f19798c1cc0e734eff28168424f9d1042122947bc895ef57bef8438a5ab1ad8505507d5fcc55514e3d66bf532481f162ebe2d17c068ef428

          • C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

            Filesize

            79B

            MD5

            61792456a528e8d4e83c5d79cbb011f8

            SHA1

            f32f53deb042cb86e2141bbcab1724dbdb46da74

            SHA256

            9419ef6b8e251e3f04ddb39f43ccc7a77b5e9827f411f0c8bbb0fb6e9f305cf8

            SHA512

            c8f0d74a05160224f05a85e8573f8e292ea2b444ccb374458a5ae9dce0ea4078d6bb5dac0079af056c4e21a0e9dbf77986d6f8adfa254483b74ff3e7c0820db8

          • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

            Filesize

            1.8MB

            MD5

            57224988f28efe075be1ed9d9dd96a19

            SHA1

            dc77165aadda56a212c999b6ce668ad020d6a920

            SHA256

            25b35db89d1d4bb7fbc719f5ee37d0578cd0ab0559585c45c33f2721b13a8123

            SHA512

            37968b63e2e6e843207359de06bbd3160b509d8a0de780a4908863747940730e222923241472cf7c3e897985b71e4c98a0e4a5e67205ad240b37c8bfc27d6188

          • C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

            Filesize

            1.1MB

            MD5

            614c451436d08f584b631455ae01932b

            SHA1

            f343b42ad4729d575daac5af1344313959428454

            SHA256

            551f8f156eb712054202701c980958fb533fa9cba9df9b22e6644c9f5189f244

            SHA512

            8365bf161791e1dc4b24f9fe27871bb0396c39c333befe591c5a723971bb15ef140be2af8469d92d1037e79f50ae4a6a255c7c6559b35fb140d751c07bd1a51c

          • C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico

            Filesize

            132KB

            MD5

            4fe78278c727ca838a6b0a8b5d2fc924

            SHA1

            7eba94ab9295e387f43fba20fcb79bc3db1dde64

            SHA256

            af8a663dc9f9407b1a0582c835317f62c0f3fc1fbe542e1df0f9ef39e913ba45

            SHA512

            ce381dbbd80e0ccbd0e9a5b1d7c070f0bf3bd52d71ae9cd87254cad2c41b61871392595f7bffb23f215f8fabdc2fba64758eb5d1e6b97da99fe4149db54123c2

          • C:\Users\Admin\AppData\Roaming\Medal\store\store.json

            Filesize

            87B

            MD5

            3068cf68ceb904bca747668350ce56cf

            SHA1

            4004e3a47e8ffb7ba5223ac1545bae0db02242cc

            SHA256

            9571666c801a754c3148e943460195a6c7734dc97ee94c3ea37fbfc1f2944eca

            SHA512

            f2da550c64d0eb5b8b8e9c60dfeab8a8c34fc6b3548cf33979e376a0c57ec074fb426ab5e37503ddc26cc4f907e74ea40e9400d7e02aa05f35f95e8cb6de261b

          • C:\Users\Admin\AppData\Roaming\Medal\store\store.json.116269056

            Filesize

            115B

            MD5

            1567fb48d4121c4877b3dcc7df8a2df4

            SHA1

            364fd279d8a7860b749efcd3e1316fc19126b7fa

            SHA256

            0601e12abb754c04d9b8fdc1f53c84c044fa26ffb571575e476971b1edc26086

            SHA512

            785a6d73465f4e73c29febad4eb107ba5c07a1961b78eec8def4289c15ecf223b0fd41d745a76e9ce765a206519bed41bcb857db6bd3df8c72e298aa048839db

          • C:\Users\Admin\AppData\Roaming\Medal\store\store.json.2831386690

            Filesize

            17KB

            MD5

            c7f1a15b8d4eb24b1ba330880e4ba8e4

            SHA1

            bedb427cfe601875c9f600794088726e7595efab

            SHA256

            e50b69776a36c43b20fcdef8ab0c1f70c11dbb500c68f7c4759aff9959ee1d2c

            SHA512

            1e5b7df1846044e53f4043db77012769b7c157bd1eb5bc1fad818e17ef631818767c605d984bf7def768abec4db97a76ab18e63edbffb2b83bb800d5089bde57

          • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • memory/2716-4176-0x0000000000C20000-0x0000000000C40000-memory.dmp

            Filesize

            128KB

          • memory/2716-4251-0x00007FF9B01D0000-0x00007FF9B0C91000-memory.dmp

            Filesize

            10.8MB

          • memory/2716-4153-0x0000000000BF0000-0x0000000000C00000-memory.dmp

            Filesize

            64KB

          • memory/2716-4152-0x00007FF9B01D0000-0x00007FF9B0C91000-memory.dmp

            Filesize

            10.8MB

          • memory/3968-4088-0x0000000000DF0000-0x0000000000FE6000-memory.dmp

            Filesize

            2.0MB

          • memory/3968-4092-0x000000001BC60000-0x000000001BC70000-memory.dmp

            Filesize

            64KB

          • memory/3968-4091-0x00007FF9B01D0000-0x00007FF9B0C91000-memory.dmp

            Filesize

            10.8MB

          • memory/3968-4290-0x00007FF9B01D0000-0x00007FF9B0C91000-memory.dmp

            Filesize

            10.8MB

          • memory/3968-4291-0x000000001BC60000-0x000000001BC70000-memory.dmp

            Filesize

            64KB

          • memory/4784-4167-0x00007FF9CEC70000-0x00007FF9CEC71000-memory.dmp

            Filesize

            4KB

          • memory/5072-1314-0x00000000209C0000-0x00000000209CE000-memory.dmp

            Filesize

            56KB

          • memory/5072-10-0x00007FF9B01D0000-0x00007FF9B0C91000-memory.dmp

            Filesize

            10.8MB

          • memory/5072-9-0x0000000000840000-0x0000000000A16000-memory.dmp

            Filesize

            1.8MB

          • memory/5072-1282-0x00000000209F0000-0x0000000020A28000-memory.dmp

            Filesize

            224KB

          • memory/5072-11-0x000000001B7D0000-0x000000001B7E0000-memory.dmp

            Filesize

            64KB

          • memory/5072-4288-0x00007FF9B01D0000-0x00007FF9B0C91000-memory.dmp

            Filesize

            10.8MB

          • memory/5072-4289-0x000000001B7D0000-0x000000001B7E0000-memory.dmp

            Filesize

            64KB