7a6d9979780dc968ce089f5a88713743e991f0795d6394646dbfd85e3b8e38d2

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_11163381257be513bbbeed66ce5ff49c_cobalt-strike_glassworm_icedid_satacom.exe
Size 2.4MB
Sample261113-vtq3csd12x
SHA256 7a6d9979780dc968ce089f5a88713743e991f0795d6394646dbfd85e3b8e38d2
MD5 11163381257be513bbbeed66ce5ff49c
SHA1 59a22d2e2aa58d131b60a22c6bd89c1c71894d6e
SHA512 ada607156a5c8dfc035b379fd3d9a1a74a9ee236afb9fcbff5a0c4a6dc531baf2b0c8e639f567e293e0986c1e07a4823a7a1ef11b768d203dd6fabc4400fca22
SSDEEP 49152:c1kkzR2NUx4+FoRftU6ACOLkWO1isbFYe1/bTL:M4WP6ACOurnL
TLSH
T1ACC59D03E25540F9C0A9C574C396EA37AA367CCA1B2471EF16D13A623E7AF906F2D345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects executables referencing credit card regular expressions 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5a7-454.dat	INDICATOR_SUSPICIOUS_EXE_CC_Regex
behavioral2/files/0x000a00000001c85a-1339.dat	INDICATOR_SUSPICIOUS_EXE_CC_Regex

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Medal = "\"C:\\Users\\Admin\\AppData\\Local\\Medal\\current\\Medal.exe\""	Medal.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
2040	powershell.exe
2824	powershell.exe
5872	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 24 IoCs

pid	Process
2040	Medal.exe
3044	Medal.exe
688	Medal.exe
8	Medal.exe
4748	Medal.exe
1524	Medal.exe
6124	Medal.exe
5012	Update.exe
4488	Update.exe
5760	Medal.exe
2484	Medal.exe
1392	Medal.exe
3412	Medal.exe
5792	Medal.exe
4052	Medal.exe
2304	Medal.exe
5676	Medal.exe
1088	Medal.exe
3288	Medal.exe
3184	Medal.exe
460	Medal.exe
5672	Medal.exe
4164	MedalEncoder.exe
4816	crashpad_handler.exe

Loads dropped DLL 44 IoCs

pid	Process
2040	Medal.exe
3044	Medal.exe
4748	Medal.exe
4748	Medal.exe
4748	Medal.exe
3044	Medal.exe
4748	Medal.exe
1524	Medal.exe
6124	Medal.exe
5760	Medal.exe
2484	Medal.exe
1392	Medal.exe
4052	Medal.exe
4052	Medal.exe
4052	Medal.exe
4052	Medal.exe
1392	Medal.exe
2304	Medal.exe
1088	Medal.exe
460	Medal.exe
460	Medal.exe
460	Medal.exe
460	Medal.exe
5672	Medal.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4816	crashpad_handler.exe
4816	crashpad_handler.exe
4816	crashpad_handler.exe

Queries registry keys for unique system GUIDs 1 TTPs 5 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

discovery

System Information Discovery

T1082

pid	Process
4424	reg.exe
1448	reg.exe
924	reg.exe
760	reg.exe
4156	reg.exe

Uses WMI to collect hardware manufacturer information 2 TTPs 3 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
2824	powershell.exe
5872	powershell.exe
2040	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4580	cmd.exe
4640	cmd.exe
3712	cmd.exe
3836	cmd.exe
5904	cmd.exe
2004	cmd.exe
4192	cmd.exe
6116	cmd.exe
1860	cmd.exe
5316	cmd.exe
4384	cmd.exe
2716	cmd.exe
4132	cmd.exe
3036	cmd.exe
5816	cmd.exe
5696	cmd.exe
2564	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_11163381257be513bbbeed66ce5ff49c_cobalt-strike_glassworm_icedid_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_11163381257be513bbbeed66ce5ff49c_cobalt-strike_glassworm_icedid_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MedalEncoder.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MedalEncoder.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Medal.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Medal.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Medal.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Medal.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Medal.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal	Medal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal\URL Protocol	Medal.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal\shell	Medal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Medal\\current\\Medal.exe\" \"%1\""	Medal.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal	Medal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal\ = "URL:medal"	Medal.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal\shell\open\command	Medal.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal\shell\open	Medal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal\URL Protocol	Medal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal\ = "URL:medal"	Medal.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal\shell\open\command	Medal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\medal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Medal\\current\\Medal.exe\" \"%1\""	Medal.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry

T1112

pid	Process
4156	reg.exe
5944	reg.exe
832	reg.exe
5620	reg.exe
2732	reg.exe
4080	reg.exe
6004	reg.exe
2872	reg.exe
5180	reg.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5812	2026-11-11_11163381257be513bbbeed66ce5ff49c_cobalt-strike_glassworm_icedid_satacom.exe
5812	2026-11-11_11163381257be513bbbeed66ce5ff49c_cobalt-strike_glassworm_icedid_satacom.exe
2824	powershell.exe
2824	powershell.exe
2824	powershell.exe
4488	Update.exe
4488	Update.exe
4488	Update.exe
4488	Update.exe
4488	Update.exe
4488	Update.exe
4488	Update.exe
4488	Update.exe
5872	powershell.exe
5872	powershell.exe
5872	powershell.exe
2040	powershell.exe
2040	powershell.exe
2040	powershell.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe
4164	MedalEncoder.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeIncreaseQuotaPrivilege	2824	powershell.exe
Token: SeSecurityPrivilege	2824	powershell.exe
Token: SeTakeOwnershipPrivilege	2824	powershell.exe
Token: SeLoadDriverPrivilege	2824	powershell.exe
Token: SeSystemProfilePrivilege	2824	powershell.exe
Token: SeSystemtimePrivilege	2824	powershell.exe
Token: SeProfSingleProcessPrivilege	2824	powershell.exe
Token: SeIncBasePriorityPrivilege	2824	powershell.exe
Token: SeCreatePagefilePrivilege	2824	powershell.exe
Token: SeBackupPrivilege	2824	powershell.exe
Token: SeRestorePrivilege	2824	powershell.exe
Token: SeShutdownPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeSystemEnvironmentPrivilege	2824	powershell.exe
Token: SeRemoteShutdownPrivilege	2824	powershell.exe
Token: SeUndockPrivilege	2824	powershell.exe
Token: SeManageVolumePrivilege	2824	powershell.exe
Token: 33	2824	powershell.exe
Token: 34	2824	powershell.exe
Token: 35	2824	powershell.exe
Token: 36	2824	powershell.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	3044	Medal.exe
Token: SeCreatePagefilePrivilege	3044	Medal.exe
Token: SeShutdownPrivilege	1392	Medal.exe
Token: SeCreatePagefilePrivilege	1392	Medal.exe
Token: SeDebugPrivilege	5872	powershell.exe
Token: SeShutdownPrivilege	1392	Medal.exe
Token: SeCreatePagefilePrivilege	1392	Medal.exe
Token: SeIncreaseQuotaPrivilege	5872	powershell.exe
Token: SeSecurityPrivilege	5872	powershell.exe
Token: SeTakeOwnershipPrivilege	5872	powershell.exe
Token: SeLoadDriverPrivilege	5872	powershell.exe
Token: SeSystemProfilePrivilege	5872	powershell.exe
Token: SeSystemtimePrivilege	5872	powershell.exe
Token: SeProfSingleProcessPrivilege	5872	powershell.exe
Token: SeIncBasePriorityPrivilege	5872	powershell.exe
Token: SeCreatePagefilePrivilege	5872	powershell.exe
Token: SeBackupPrivilege	5872	powershell.exe
Token: SeRestorePrivilege	5872	powershell.exe
Token: SeShutdownPrivilege	5872	powershell.exe
Token: SeDebugPrivilege	5872	powershell.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
3044	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe
1392	Medal.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4164	MedalEncoder.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 2040	5812	2026-11-11_11163381257be513bbbeed66ce5ff49c_cobalt-strike_glassworm_icedid_satacom.exe	89
PID 5812 wrote to memory of 3044	5812	2026-11-11_11163381257be513bbbeed66ce5ff49c_cobalt-strike_glassworm_icedid_satacom.exe	90
PID 3044 wrote to memory of 688	3044	Medal.exe	91
PID 3044 wrote to memory of 1860	3044	Medal.exe	92
PID 1860 wrote to memory of 4156	1860	cmd.exe	94
PID 3044 wrote to memory of 4132	3044	Medal.exe	95
PID 4132 wrote to memory of 5944	4132	cmd.exe	97
PID 3044 wrote to memory of 3712	3044	Medal.exe	98
PID 3044 wrote to memory of 5316	3044	Medal.exe	99
PID 5316 wrote to memory of 4424	5316	cmd.exe	102
PID 3712 wrote to memory of 5844	3712	cmd.exe	103
PID 3044 wrote to memory of 2824	3044	Medal.exe	104
PID 3044 wrote to memory of 4748	3044	Medal.exe	106
PID 3044 wrote to memory of 8	3044	Medal.exe	105
PID 3044 wrote to memory of 1524	3044	Medal.exe	108
PID 3044 wrote to memory of 2564	3044	Medal.exe	109
PID 2564 wrote to memory of 1448	2564	cmd.exe	111
PID 3044 wrote to memory of 6124	3044	Medal.exe	113
PID 3044 wrote to memory of 4492	3044	Medal.exe	114
PID 3044 wrote to memory of 5012	3044	Medal.exe	117
PID 3044 wrote to memory of 4488	3044	Medal.exe	118
PID 4488 wrote to memory of 5760	4488	Update.exe	119
PID 4488 wrote to memory of 2484	4488	Update.exe	120
PID 4488 wrote to memory of 1392	4488	Update.exe	121
PID 1392 wrote to memory of 3412	1392	Medal.exe	123
PID 1392 wrote to memory of 3036	1392	Medal.exe	124
PID 3036 wrote to memory of 4080	3036	cmd.exe	126
PID 1392 wrote to memory of 5904	1392	Medal.exe	127
PID 1392 wrote to memory of 3836	1392	Medal.exe	128
PID 1392 wrote to memory of 5872	1392	Medal.exe	180
PID 1392 wrote to memory of 5792	1392	Medal.exe	132
PID 1392 wrote to memory of 4052	1392	Medal.exe	133
PID 1392 wrote to memory of 5676	1392	Medal.exe	135
PID 5904 wrote to memory of 4588	5904	cmd.exe	136
PID 3836 wrote to memory of 924	3836	cmd.exe	137
PID 1392 wrote to memory of 4580	1392	Medal.exe	138
PID 4580 wrote to memory of 760	4580	cmd.exe	140
PID 1392 wrote to memory of 2304	1392	Medal.exe	141
PID 1392 wrote to memory of 4008	1392	Medal.exe	142
PID 1392 wrote to memory of 6004	1392	Medal.exe	144
PID 1392 wrote to memory of 2872	1392	Medal.exe	145
PID 1392 wrote to memory of 832	1392	Medal.exe	148
PID 1392 wrote to memory of 5620	1392	Medal.exe	150
PID 1392 wrote to memory of 5180	1392	Medal.exe	151
PID 1088 wrote to memory of 3288	1088	Medal.exe	156
PID 1392 wrote to memory of 4640	1392	Medal.exe	157
PID 1088 wrote to memory of 2004	1088	Medal.exe	158
PID 1392 wrote to memory of 4192	1392	Medal.exe	159
PID 1392 wrote to memory of 5816	1392	Medal.exe	160
PID 4640 wrote to memory of 4092	4640	cmd.exe	165
PID 5816 wrote to memory of 1236	5816	cmd.exe	166
PID 2004 wrote to memory of 2732	2004	cmd.exe	167
PID 4192 wrote to memory of 6072	4192	cmd.exe	168
PID 1088 wrote to memory of 2716	1088	Medal.exe	169
PID 1088 wrote to memory of 2040	1088	Medal.exe	171
PID 1088 wrote to memory of 3184	1088	Medal.exe	173
PID 1088 wrote to memory of 460	1088	Medal.exe	174
PID 1088 wrote to memory of 5672	1088	Medal.exe	175
PID 2716 wrote to memory of 4156	2716	cmd.exe	176
PID 1392 wrote to memory of 6116	1392	Medal.exe	177
PID 1392 wrote to memory of 4384	1392	Medal.exe	178
PID 1392 wrote to memory of 5696	1392	Medal.exe	179
PID 5696 wrote to memory of 5008	5696	cmd.exe	183
PID 4384 wrote to memory of 2152	4384	cmd.exe	184

C:\Users\Admin\AppData\Local\Temp\2026-11-11_11163381257be513bbbeed66ce5ff49c_cobalt-strike_glassworm_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_11163381257be513bbbeed66ce5ff49c_cobalt-strike_glassworm_icedid_satacom.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
  "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --veloapp-install 2645.618.1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2040
- C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
  "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
    C:\Users\Admin\AppData\Local\Medal\current\Medal.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Medal /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Medal\Crashpad "--annotation=_companyName=Medal B.V." --annotation=_productName=Medal --annotation=_version=2645.618.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=44.9.3 --initial-client-data=0x488,0x48c,0x490,0x45c,0x494,0x7ff74ddd5a58,0x7ff74ddd5a68,0x7ff74ddd5a78
    3⤵
    - Executes dropped EXE
    PID:688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query HKCU\Software\Medal /v UUID"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Windows\system32\reg.exe
      reg query HKCU\Software\Medal /v UUID
      4⤵
      Modifies registry key
      PID:4156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add HKCU\Software\Medal /v UUID /t REG_SZ /d 3b7be8ff-0358-467c-9f1e-648889547fda /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Medal /v UUID /t REG_SZ /d 3b7be8ff-0358-467c-9f1e-648889547fda /f
      4⤵
      Modifies registry key
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "fltmc"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\system32\fltMC.exe
      fltmc
      4⤵
      PID:5844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5316
  - - C:\Windows\system32\reg.exe
      reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid
      4⤵
      Queries registry keys for unique system GUIDs
      PID:4424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c "Get-CimInstance -ClassName Win32_VideoController | Format-List -Property Name, Description, Caption, AdapterRAM"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Uses WMI to collect hardware manufacturer information
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
    "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --standard-schemes=medal,medal-fs --secure-schemes=medal,medal-fs,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=medal-fs,sentry-ipc --fetch-schemes=medal-fs,sentry-ipc --streaming-schemes=medal-fs --field-trial-handle=2800,i,16884694547292510172,9307323327804845575,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2804,i,14007719210705089720,13219304183267666479,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2832 /prefetch:11
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    PID:8
- - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
    "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=2800,i,16884694547292510172,9307323327804845575,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2804,i,14007719210705089720,13219304183267666479,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2796 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4748
- - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
    "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --standard-schemes=medal,medal-fs --secure-schemes=medal,medal-fs,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=medal-fs,sentry-ipc --fetch-schemes=medal-fs,sentry-ipc --streaming-schemes=medal-fs --app-user-model-id=com.squirrel.medal.medal --app-path="C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar" --enable-sandbox --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=651694771 --field-trial-handle=2800,i,16884694547292510172,9307323327804845575,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2804,i,14007719210705089720,13219304183267666479,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1524
- - C:\Windows\system32\cmd.exe
    cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\system32\reg.exe
      reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid
      4⤵
      Queries registry keys for unique system GUIDs
      PID:1448
- - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
    "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --standard-schemes=medal,medal-fs --secure-schemes=medal,medal-fs,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=medal-fs,sentry-ipc --fetch-schemes=medal-fs,sentry-ipc --streaming-schemes=medal-fs --app-user-model-id=com.squirrel.medal.medal --app-path="C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar" --enable-sandbox --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=658533805 --field-trial-handle=2800,i,16884694547292510172,9307323327804845575,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2804,i,14007719210705089720,13219304183267666479,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3992 --renderer_name=main --app-path="C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar" --device-name=Cziefeeq --os-release=10.0.26100 --fresh-install=true --installed-at=1794590264297 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6124
- - C:\Windows\system32\mountvol.exe
    mountvol
    3⤵
    PID:4492
- - C:\Users\Admin\AppData\Local\Medal\Update.exe
    "C:\Users\Admin\AppData\Local\Medal\Update.exe" patch --old C:\Users\Admin\AppData\Local\Medal\packages\Medal-2645.618.1-full.nupkg --output C:\Users\Admin\AppData\Local\Medal\packages\Medal-2646.632.1-production-full.partial --delta C:\Users\Admin\AppData\Local\Medal\packages\Medal-2646.632.1-production-delta.nupkg
    3⤵
    - Executes dropped EXE
    PID:5012
- - C:\Users\Admin\AppData\Local\Medal\Update.exe
    "C:\Users\Admin\AppData\Local\Medal\Update.exe" apply --package C:\Users\Admin\AppData\Local\Medal\packages\Medal-2646.632.1-production-full.nupkg --waitPid 3044 --root C:\Users\Admin\AppData\Local\Medal --packageDir C:\Users\Admin\AppData\Local\Medal\packages
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
      "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --veloapp-obsolete 2645.618.1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5760
  - - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
      "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --veloapp-updated 2646.632.1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2484
  - - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
      "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe"
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
        
        C:\Users\Admin\AppData\Local\Medal\current\Medal.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Medal /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Medal\Crashpad "--annotation=_companyName=Medal B.V." --annotation=_productName=Medal --annotation=_version=2646.632.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=44.9.3 --initial-client-data=0x4a0,0x4a4,0x4a8,0x474,0x4ac,0x7ff6fbc55a58,0x7ff6fbc55a68,0x7ff6fbc55a78
        5⤵
        Executes dropped EXE
        
        PID:3412
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query HKCU\Software\Medal /v UUID"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3036
      - C:\Windows\system32\reg.exe
        
        reg query HKCU\Software\Medal /v UUID
        6⤵
        Modifies registry key
        
        PID:4080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "fltmc"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5904
      - C:\Windows\system32\fltMC.exe
        
        fltmc
        6⤵
        
        PID:4588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3836
      - C:\Windows\system32\reg.exe
        
        reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid
        6⤵
        Queries registry keys for unique system GUIDs
        
        PID:924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c "Get-CimInstance -ClassName Win32_VideoController | Format-List -Property Name, Description, Caption, AdapterRAM"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Uses WMI to collect hardware manufacturer information
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
        
        "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --standard-schemes=medal,medal-fs --secure-schemes=medal,medal-fs,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=medal-fs,sentry-ipc --fetch-schemes=medal-fs,sentry-ipc --streaming-schemes=medal-fs --field-trial-handle=2412,i,1927607926695809630,13492497984992853320,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2416,i,17401688271307591295,13481184899848776266,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2448 /prefetch:11
        5⤵
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
        
        "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=2412,i,1927607926695809630,13492497984992853320,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2416,i,17401688271307591295,13481184899848776266,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2408 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
        
        "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --standard-schemes=medal,medal-fs --secure-schemes=medal,medal-fs,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=medal-fs,sentry-ipc --fetch-schemes=medal-fs,sentry-ipc --streaming-schemes=medal-fs --app-user-model-id=com.squirrel.medal.medal --app-path="C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar" --enable-sandbox --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2412,i,1927607926695809630,13492497984992853320,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2416,i,17401688271307591295,13481184899848776266,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:5676
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4580
      - C:\Windows\system32\reg.exe
        
        reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid
        6⤵
        Queries registry keys for unique system GUIDs
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
        
        "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --standard-schemes=medal,medal-fs --secure-schemes=medal,medal-fs,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=medal-fs,sentry-ipc --fetch-schemes=medal-fs,sentry-ipc --streaming-schemes=medal-fs --app-user-model-id=com.squirrel.medal.medal --app-path="C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar" --enable-sandbox --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2412,i,1927607926695809630,13492497984992853320,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2416,i,17401688271307591295,13481184899848776266,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3836 --renderer_name=main --app-path="C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar" --device-name=Cziefeeq --os-release=10.0.26100 --fresh-install=true --installed-at=1794590283613 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2304
    - - C:\Windows\system32\mountvol.exe
        
        mountvol
        5⤵
        
        PID:4008
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
        5⤵
        Modifies registry key
        
        PID:6004
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Medal
        5⤵
        Modifies registry key
        
        PID:2872
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Medal
        5⤵
        Modifies registry key
        
        PID:832
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
        5⤵
        Modifies registry key
        
        PID:5620
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Medal
        5⤵
        Modifies registry key
        
        PID:5180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\NVIDIA Corporation\Global\ShadowPlay\NVSPCAPS""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4640
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\Software\NVIDIA Corporation\Global\ShadowPlay\NVSPCAPS"
        6⤵
        
        PID:4092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\NVIDIA Corporation\Global\ShadowPlay\NVSPCAPS""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4192
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\Software\NVIDIA Corporation\Global\ShadowPlay\NVSPCAPS"
        6⤵
        
        PID:6072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\NVIDIA Corporation\Global\ShadowPlay\NVSPCAPS""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5816
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\Software\NVIDIA Corporation\Global\ShadowPlay\NVSPCAPS"
        6⤵
        
        PID:1236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\WOW6432Node\Valve\Steam""
        5⤵
        Executes a command shell one-liner
        
        PID:6116
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5872
      - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\WOW6432Node\Valve\Steam"
        6⤵
        
        PID:3660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Overwolf\Outplayed""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4384
      - C:\Windows\system32\reg.exe
        
        C:\Windows\system32\reg.exe QUERY "HKCU\Software\Overwolf\Outplayed"
        6⤵
        
        PID:2152
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5696
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
        6⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\MedalEncoder.exe
        
        C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\MedalEncoder.exe --electronPort 10603 --environment production --wsComms
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\crashpad_handler.exe
        
        C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\sentry-db --metrics-dir=C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\sentry-db --url=https://sentry.medal.tv:443/api/1509393/minidump/?sentry_client=sentry.native/0.7.6&sentry_key=f2ea4e2bebb44129b30402d5b4076fd5 --attachment=C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\sentry-db\07d1e81a-a043-43f3-75bd-a4881804a6db.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\sentry-db\07d1e81a-a043-43f3-75bd-a4881804a6db.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\sentry-db\07d1e81a-a043-43f3-75bd-a4881804a6db.run\__sentry-breadcrumb2 --initial-client-data=0xad8,0xadc,0xae0,0xab4,0xae4,0x7ffba5bc8800,0x7ffba5bc8818,0x7ffba5bc8830
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4816

C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
"C:\Users\Admin\AppData\Local\Medal\current\Medal.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
  C:\Users\Admin\AppData\Local\Medal\current\Medal.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Medal /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Medal\Crashpad "--annotation=_companyName=Medal B.V." --annotation=_productName=Medal --annotation=_version=2646.632.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=44.9.3 --initial-client-data=0x4a8,0x4ac,0x4b0,0x47c,0x4b4,0x7ff6fbc55a58,0x7ff6fbc55a68,0x7ff6fbc55a78
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query HKCU\Software\Medal /v UUID"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\reg.exe
    reg query HKCU\Software\Medal /v UUID
    3⤵
    - Modifies registry key
    PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\system32\reg.exe
    reg query HKLM\Software\Microsoft\Cryptography /v MachineGuid
    3⤵
    - Queries registry keys for unique system GUIDs
    PID:4156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c "Get-CimInstance -ClassName Win32_VideoController | Format-List -Property Name, Description, Caption, AdapterRAM"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
  "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2572,i,10290673420877710251,7810879044240513766,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2592,i,5252599008278762384,11412848382182920595,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2640 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3184
- C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
  "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=2572,i,10290673420877710251,7810879044240513766,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2592,i,5252599008278762384,11412848382182920595,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2556 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:460
- C:\Users\Admin\AppData\Local\Medal\current\Medal.exe
  "C:\Users\Admin\AppData\Local\Medal\current\Medal.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Medal" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --app-user-model-id=com.squirrel.medal.medal --app-path="C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2572,i,10290673420877710251,7810879044240513766,262144 --enable-features=AllowWindowCaptureExclusionInRemoteSessions,DocumentPolicyIncludeJSCallStacksInCrashReports,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2592,i,5252599008278762384,11412848382182920595,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3008 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5672

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F4
1⤵
PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

medal-hook64-v2.dll

Path C:\Users\Admin\AppData\Local\Medal\HookDLL\MedalHook_Vulkan_134390639344128633\medal-hook64-v2.dll
Size 861KB
SHA256 5e672b35ca7c9e99da48e319802e13a87b5004646125909bf8c61b5726a9bafc
MD5 98d3fb1905dd84ee8627a39ca2202ff3
SHA1 5c315ba85ddc26bc2a0345df151d09f6cc82c26b
SHA512 df9cbc51aca05aa383f61d36efe8304a2487a209de0eef993edeba52a463855fe8b401e8e8276b7b326679ed8062c07845a4ee29ef9a7a23ebfa85f8c0c9bdef
SSDEEP 6144:cGKVJEOyjGxtX57Z0rMaDoIqhV/+KDjDa2y1ICtqpuzlZ9kDP9BKc85:cDiOWGf30rMaDmhV/+KDjDvxom9BKc85
TLSH
T170159E262BA812E6D477D13D8DD78F5AE6B2F8140320ABC7019542AD3F23BE45E3E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

medal-vulkan64-v2.json

Path C:\Users\Admin\AppData\Local\Medal\HookDLL\MedalHook_Vulkan_134390639344128633\medal-vulkan64-v2.json
Size 523B
SHA256 3d276a58459500a8443da161f94cd3228147e3c8447550af05293d92eff3a44d
MD5 6303e1dbd70bff7d2d630ede2ba2af2a
SHA1 436b96a9777ec30b5971a09dd2cf7d36e9f00d08
SHA512 05f5b6714bb6e0b2142e01d6767cec38d4a71bf7760a0cf6006ea623a7717660291f9cbce1582ba207abc38ed7d5c84d980a1571e54cba9114735d01630f14f8
TLSH
T195F0E51ECE52CE930636572DA8B60A1AFBA1032F14000D5679BC106C5F79BBBA10EF2C
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\Medal\Update.exe
Size 2.8MB
SHA256 1c030fefc0dbf83037ed521b59ac807429ebbaa12b3cb0ff3f35f08e0da8a053
MD5 51be1c44a53e441142ba1c682a7905f6
SHA1 ce9da0ddfd0cceda2f1beb212565088aab8909b9
SHA512 31e017c6d65d055db58d91b9cae7e9853fd103f0679ecb01dab7779f5d17f45150fff596b6750e8c626ad90971deeb42613db8ba512a7809bafc59ef27c97e99
SSDEEP 49152:4kllaitBGzMg3v8WLTM1mTDfGRt85yxrI//Sec4sB7mFYmC0DbO:44EcADfGRt85B4QDq
TLSH
T166D58D43F28440F9C0A9C174C7569A37EB76BCC61A29719F16D0BA623E3AF909F2D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Medal\current\D3DCompiler_47.dll
Size 4.5MB
SHA256 db896464cb8d914153a07add7b256c767f5c00f1f98d141e5c5699ee6aaf203f
MD5 cea998b110c2ef3e91280b81e9a0bdda
SHA1 2d48d1586e37e8cd04b6ed46c4ec90dc8060392e
SHA512 dc45596ea4f3dc8196a2891458655baccc2eb056c4733aae3b85e05280c8b835d5397e1004c7dbc42cf8d5c1b2fd157bb7be8750f01912b2b6a73850bd892359
SSDEEP 49152:r6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/F:rUdeqt737jFm5wN
TLSH
T1F2268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Medal\current\chrome_100_percent.pak
Size 702KB
SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
MD5 8bd180ba5ae087e7348c8e5d3fc747b9
SHA1 032e54936f0a96b9e008a77666e8739f6ff56341
SHA512 8f52ca1c25bbfacefdeb869ba8b2725a12269f5df40ae50744bcb7f4f68df6cf8ab6a6a63116969d07a9ca80caaadcd6b3542f056cf1317e55e7c1bfe8c2b28b
SSDEEP 12288:QI3HWfJwNjzgsz5B0GDJQrnKs8SNP+QSsEHeilSTe+gnzzmg/YJblIt6kjKQCrC:H32Bw7zEEmPLVbTe+gnzzmgwbc6kGQt
TLSH
T159E412E77370AC7DEEAB1677426614B0FC375A280B51060A17DAF8796923B48D8D93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Medal\current\chrome_200_percent.pak
Size 1.2MB
SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
MD5 62dc1994f062c83fce3944c829165007
SHA1 1ab2de2406114a4c4e32ca3dc4d6f8515cb4d6cd
SHA512 1d4b7acedaa54d376764ea1709750cb102b326fa4a993bad7b8ef4c4961950c52541dd79a8789709bfaa5aebbed0c6fe5a781866512c56da660ea7ed2c55befd
SSDEEP 24576:73WBS9n2zLmmibkFR8+mZiqr8BWhQumesXRvQtgIQwuSXAkpbaUGQ74:73P23mNbkFRJmQ+8khQRn1Q68uSXAk78
TLSH
T1754522D7D770AC3EDD520B77939B20E0FD7600271A61190F0B26BD7929276C8DA96B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\Medal\current\dxcompiler.dll
Size 24.6MB
SHA256 d9c810befbfb3414602a497663d9ed241610830a767935a77dd1d8a5b690c021
MD5 8105ab820efead3ffc4d22a756c1239d
SHA1 0dd951f9e536e848d0bdf252a48d7bbec9ba3bc3
SHA512 1bcfe687eddbf1b7950769e55db6d8dd5531bd181d24377782b08f0ad96b017933920dd9a77fcd3f36ec6c82d9fc0613b757f61625404bd1a259114d059151b3
SSDEEP 393216:VQr4pu+3f1Nfcue8m7ibHKrGOw9mrbzAzj1NZCpFM:Vw+ve7ibHBOTrbMj1sFM
TLSH
T109472A122646D49CC099C879C7678B268A6C30E73FA7B9DFC0F461212B79DBC5B39235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\Medal\current\dxil.dll
Size 1.4MB
SHA256 411ff53ffd2a90dd7c41b87e6cf92a80b78fa9d598850e3a7721663ca9595989
MD5 7350b72b68497e896b89ef7a0079ccb0
SHA1 3f29659ee9d74f2d7b4e162636d2c6cdc1d65dc7
SHA512 7cac95eab41d5f8bd6f1ccae27f1840578ac484f9740a7ecc7484e5f3fe1f175228cabd73e34b124b2817ed87e4ced2c6da18410a38ff7acd2b346daee87a40b
SSDEEP 24576:3cuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/U:3sHMPzbOxBduHdSCde8ZF1/0Wy4oV6bZ
TLSH
T18C657D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Medal\current\ffmpeg.dll
Size 3.0MB
SHA256 460a621294865874a91ff4727bb6c083c08bf8249bd61e36a2bd6ed1b1d0e9e9
MD5 cc128c69bf424cd446338a1a38842211
SHA1 b2657b076bfeccf233409fddd35a8b4c68a51edf
SHA512 c4fa8e34a5a68b7dd47b18fd274cf4257de3e984488629740834b16779a2ef6dddf991c7fa1477d2dcfc7fcbccd6edc468088a91e2143e8027107e113eb8e805
SSDEEP 49152:sagye0i1JBlvS0ZU3oAQULMsvpTwDowaY9/Gz/YaLuPPuf0E6OOlz2PzB:sJ1lS0ZcoAs9HaLu3heN
TLSH
T11CE5AE03F6D251EDD019C03497AB9213F271780A8F205AEF17A05A253F66FE86D7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Medal\current\icudtl.dat
Size 10.4MB
SHA256 da53f0b69843aaa43315f0f210a67e4a874b0be338f3dae08ff57b8afe76ab0d
MD5 d5136270d87d40d2c1c6df098f53002a
SHA1 d167e8c8183258dc8714a84993b823dbd7390add
SHA512 55709f3a14e9402860ff2648bde887e7bb7674278c088e36ce20e6b107735cca68a210a091ca72f816803d27998e188b78aedf18cbfa24ad17cbfd4caec9376b
SSDEEP 98304:g/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjnd0p89s:g/cBhORok2HiXUxO/RJk3IWhlYntjdPs
TLSH
T136B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Medal\current\locales\en-US.pak
Size 572KB
SHA256 23b271e8009bfa14783700cd0712b4ecaa5b8f2ea28a4d81ae1d7e05bc0c96b1
MD5 3d66180f21df40a9eb941814676972eb
SHA1 b74b6ceba72cd5ca9e662acca19285037995c362
SHA512 4ef14702236e389409bd875dfc0b3f467f8b15c9e97c13dacedfc751642445141de31d6ccc574c8aa4dd788c2e756a16ded3262eb0c577b2b0e82ff526638efc
SSDEEP 6144:pUTO8xSUd/7b7/wg7HfwKOF7Nt3/p9XhMP96hgREfaY+43Um8tjmngcs/wEwj:mqL8f7/weHfwpNbMUhgR2uj1wj
TLSH
T12AC44D1FF784122A05935262BF099572FF32D06CA36112663CBD812C3376B66D2B76F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Medal\current\resources.pak
Size 11.9MB
SHA256 9611f9a65a37eea7d7f631eba0ed2cc49205f47aaa8a2937694ca2de2d821bd8
MD5 833e5095756c9adfd7b0448db0bab21b
SHA1 0517ac1f2294885172054feff643f31dc1288fe2
SHA512 952c59cc681c141292656918bf07eb13f019dcd716cacbbe90b55533e46cca084b158e47ae07f17ed923626ce11dc486097a907788b98e24a4c4072e2ba5514c
SSDEEP 196608:PRR3ZeqsPzZOgYimq8oR/5e7sbaQSX2CeVh2uDK3Q12OmsE5OkrFAceC/Zh2tX3L:PLZelLgg9mno8sbV02CM8fOkrFJeCD2N
TLSH
T109C633983764286FDE2123F3822D1237DA69DD0B156550E30EAC3058DEB396C9FDE939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar
Size 39.1MB
SHA256 15946f0120db425778ec373abbedb89d419e15a86752d3a99aa413ee079e2a71
MD5 a157d845d6395891623920c8ca085cbc
SHA1 1188711d8eb0e9566f89ec62c5235d1340e02353
SHA512 e8e53fa47e953d3129208e83a8d843477a5a38f074072469d9c9455e6c5701fb03ad16c4ab63c869b43d16d69a100e56609662aedc02d4c432e80f3d113434de
SSDEEP 196608:pdpHqgDf0xA9S2cHbzE/fRaRD24qsMHypS1sUcdBcBMky5o:HpHqgiA9S2cHbw/O8ypjYBMkZ
TLSH
T1D89727497190287F9DE2F1E1E0B7241561AD2230E18A50D4A3788BB97FD7C8DDBF2B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar
Size 38.6MB
SHA256 2c1832fa80c3349d45ef93be42b855e017b4730fad3f078113f85a174b5d9e95
MD5 3f719011e67296696f10bd54f11783ff
SHA1 54be5f48b495ede0ebf2c35f869fe62081443e4d
SHA512 24c683d1b4c38dfddb1b6867d2d1c5b36ada447c9621f2ded736965a4f710adf1f12bd146c386721460ea03260eba8c9592fb15aff9855a2dc0b280bc2628f77
SSDEEP 196608:0dpHuuYP1QA/fzQgferYlaRD2ptsGZ5UqbcclBjlVyRqHU9K/o:+pHuugQA/fsgferA/53VblVysHU9T
TLSH
T1C99727497190287F9CE2F1E1E077241561AD2630E18A90D4A3788BB97FD7C8DDBF2B64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

better_sqlite3.node

Path C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar.unpacked\lib\binding\napi-13.0.3-win32-x64\better_sqlite3.node
Size 1.9MB
SHA256 3b5fdc4b1acc693b75a79098b7297aef02f4323146292193ffc997cacf7334b2
MD5 377b5b1ff7fd74f766434ad8173f6df2
SHA1 45e068087fe0d64771ba024389d2477aec62c63a
SHA512 91b70514fa370480da0bde995ec0be29001f49a7bb7f3edfa3eaad37a50ef40b41a4fd4c06223e744dd6df49a43b83d652033a0a993aca3f674c2e32e4d63797
SSDEEP 49152:BziOQrp7DIgMLtxQSCCgJtq0VgwGwheL07QCDqkrPKZJ:w5DHMLMSCCgJM0oJ
TLSH
T1DE958E4BE2B400FDC1ABC2B9851B5A07E7B1740517749BDB05D0CA696F63FE216BE328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack_nodeffi_win_x64_msvc.node

Path C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar.unpacked\node_modules\velopack\lib\native\velopack_nodeffi_win_x64_msvc.node
Size 1.6MB
SHA256 68d58bc5f24cf460fcf1336512d16486997fc1a95acd28800a75a9e45eb34d2c
MD5 71a021f5d3d4e9312aa2f9d241ffcbeb
SHA1 834025950f179d2b53f7bb55e17c4d8a2aa9f3e0
SHA512 2aba4650f5da71080a18150cc5633db24a0e57acc5343d22893d643ec2b6c51c3ddece2e7c5ce0a79a6f1a625b3b6d7f3bb35547077d40aad33b70b31970ff66
SSDEEP 49152:BCTC2MJZUlSmghp+sDthiBHSpE89yfxvfs7UD:BI+mLByu4ID
TLSH
T1C5858D03F65981E8C5AEC478C397913BAB7278890B35B6EF17945B253E26FD05B2C305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

animated-medal-logo.webm

Path C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar.unpacked\src\assets\animated-medal-logo.webm
Size 14KB
SHA256 b7681298f6ad78f17eaf3b99be71a55f2dce5e1f181115f29db572504e2fe5f3
MD5 431e7f6f24988d4dfe00ca684b385bb8
SHA1 62e4c4ee285817781446c9167f799e5a60c6a2d3
SHA512 5fc0c512b0318648273991d35c44b6e1dbbbd3b6142335a0765c90d4004c923c463f7509f3f9d82b32a338fc64071a9e4a2f1ffb4ef310d56d86fb9c0ca2c418
SSDEEP 384:QOgvE3EIlHVizdwFwOnvVuQ5ngDvNmERCHvQFKcOA68:FAhIidwFwM9uQ5ngDvNmERXUcOK
TLSH
T1DA626BE0ECB0B442D15437FDF2EE6859F8CD70561769289478BB9984ACF5ACCC42C2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MedalApp.png

Path C:\Users\Admin\AppData\Local\Medal\current\resources\app.asar.unpacked\src\assets\icon\MedalApp.png
Size 53KB
SHA256 70e478d514f6519cc38081a0c28bb22869f3b815e4a661079b7179d5b6274bf9
MD5 ce096ef77c8a88b0fd062ed5f919e19e
SHA1 2dc666ac70d1d9bf170f2cc6ff1536c4755ec685
SHA512 421961ee63c56bb86618bddb8f9de18aaa1688fd7f1f37567f61ee7cd7385c1096346d99f464090fc036ecf3f700af6ea32b5fd96650c4d5d3c56a8760bf2e42
SSDEEP 1536:si9gJpxv/YgHW+JKpFcMO4X0FmCN9WaD1ubilOq:LM67O4KXD1uq
TLSH
T1A933026BEA316C74860A431E65C77EA9ED37692407218222485274FE7CDFF8F9C218CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\Medal\current\sq.version
Size 600B
SHA256 c883b93f3c722ef7aa8a5683226f456395706dfbbf80a55a0752c39db8c2b780
MD5 83bcc98a7cf9ee4417a15375236a49ef
SHA1 b94249cfee0f74f9f9afb9fef463c24182863214
SHA512 735673ec1f99f9fca20799e8400b2a41d2069c55271c69b461216d3d3a72193815689fa42f40f39651a0edf2bf36f1135a705cbbad1c523c97ff514b84e28362
TLSH
T147F00CC88280ED0D62B3667C5480C31CF3EBAA9A78C58984CC491C0F36C21CFAA5BD40
MD5 SHA1 SHA512 TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\Medal\current\sq.version
Size 600B
SHA256 adca435ee00b34c40cf72f30b0140a35417ec0ec474c95cc47b0dad735cb5a9e
MD5 c95503943a71d2a957da4b214249e1cf
SHA1 d8f6db5af3605657bc67d5ff72a918d45a8e1982
SHA512 c55f13048e3a3cb3254e7e1f2853eb3dc9a456f2a056d2838237a5e39b4be90828f5ed64d5680b62e2e2995faf62eb691b5d5adbd9f32cafc2aa034ba889fe04
TLSH
T153F0ACC98684ED0962B7667C5484C31CF3EBAA5A78C98A94CC491C0F76C21CFAA5BD81
MD5 SHA1 SHA512 TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Medal\current\v8_context_snapshot.bin
Size 725KB
SHA256 9c954486def5b03cf2f92f63743c83c024324e1fee6389b9364b9474907300d6
MD5 cbd7658d2470169cb0d5052ffbf28483
SHA1 0954aacca2bf9ccee42b5c26857d09ad49a89810
SHA512 cd0082f5ce0217b995b5a9ee1aa141ee4422c21b0f537a7064d465b0cc2596464402ca617b860542213729db5634a29bc644752799cc1ccc6c4633c5bc8449da
SSDEEP 6144:7t+HwX1l/5K7Rfqz2W6tArYVLrgV2wXuIr2ffLkzdjTncO6vTB5lU7HqpAO1UjM6:HrBK1fqz2W6NPsKXCwlz5DHtM
TLSH
T141F4B3B6F50B8B35CA951B3D8EEB8E4B3A74F09DEE87C10B3151577C65B96A08E4240C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Medal\current\vk_swiftshader.dll
Size 5.3MB
SHA256 c0ce6b252e309ad4fc98da4b73213bc53e322f0190bfc8c748711a0f5d9fd1b8
MD5 d760d3c45a9eeda7b1c8b968b4983a5e
SHA1 d9ff0b921f54f678472c8f45a52f311850a98785
SHA512 3774c126abd9402f749c9c504a58986fca3a12aeb551c5f2d6c1deddec60670e7d53901cd7e6573243a2342c99f7e5e6beb2141c7f7d2fa5a08eeaf26efe4fb2
SSDEEP 49152:aAYcIG6hbYI8JKh6tIfH1GBMfoeRqmX1TNj5/9swRsZGiAxOTQRaeMHed8RwwlWe:aAYcA38XPgrpAeq97
TLSH
T181464903F69681D9C06DE6798B5FA623F631F8800B2276DF56A00F192E66FE0673D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Medal-2646.632.1-production-delta.nupkg

Path C:\Users\Admin\AppData\Local\Medal\packages\Medal-2646.632.1-production-delta.nupkg
Size 2.9MB
SHA256 24a7bd039e9fd3c87c93a5cb740ce2bf3bcee9b44b3f8329409363bbae5f7b3c
MD5 6df02a1907edde53257288f0bbe3de9c
SHA1 7c7061eadbbcb19824bc0169ea5885f53c674c4d
SHA512 5319178830838588f1a0c077337777ae1643b3c8043f9f1d42133d8f8f2704ac964dcd0ae28a03a6337ebe56baf2d0827de520d300fae2a5440ece742705e2d2
SSDEEP 49152:Wc+oEaMOA5b5oLjCdE+xdO2HlfFz6Y3VZNtL5kHEd24+P9T7WRn+i49g+dTVoo6G:Wc+YM1b5oP3+dOq9FZpcEd24a9/WRnlI
TLSH
T167E501E6086D7932FAB3B0FD255041CBE44F6B4144AAD79DC5EA10022C775FBE266C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hotkey-xbox-paddle-1.svg

Path C:\Users\Admin\AppData\Local\Medal\packages\VelopackTemp\tmp_iEd8Yg7jqMV7g8kc\resources\app.asar.unpacked\src\assets\icons\standard\hotkey-xbox-paddle-1.svg
Size 824B
SHA256 5bc532d16323d210072132e2b553dc3b31caaca4f4e7cf1d3669f8ff7308e918
MD5 20572609ac4a973b759710b824a37282
SHA1 b85cf775aec5b1e2b56cbf52aebadcb4ac2b3fc9
SHA512 563802d30aa7b3e6568acd85a3eccf120c1c798e3b3baea925995c57c0b305bc6661fb73904f6fbf7ddda27cb93a5c306f0d2e9c720e9bd5038522a5d1e75327
TLSH
T1D201FDE5E289D1A1D805973CD2340B302B6732BD2BD7CC8A83612F0CF8092EA450AA60
MD5 SHA1 SHA512 TLSH

Submit Download

hotkey-xbox-paddle-2.svg

Path C:\Users\Admin\AppData\Local\Medal\packages\VelopackTemp\tmp_iEd8Yg7jqMV7g8kc\resources\app.asar.unpacked\src\assets\icons\standard\hotkey-xbox-paddle-2.svg
Size 1KB
SHA256 07842e932352b9a5ac7499eec63787fc3e3c0d29223bae03bf5b68a7a463811b
MD5 67b6c32baf0123f6b7ba6920e093d6c6
SHA1 da928dc7cc3082bb14c0f01439cbed7d817dc361
SHA512 26662eac19d7e0cc432d31ff3a58f9d4f73d119e5554b525742b76551b12618bfcfb11580af7326ac42a48bd0fd15d0622ffff1e94f13627e319a6cc11e0d19a
TLSH
T1F92123E943C5E3C0F004A338DE7466390B5734F83B2A8D8883727B84F8061E6A00FD91
MD5 SHA1 SHA512 TLSH

Submit Download

hotkey-xbox-paddle-3.svg

Path C:\Users\Admin\AppData\Local\Medal\packages\VelopackTemp\tmp_iEd8Yg7jqMV7g8kc\resources\app.asar.unpacked\src\assets\icons\standard\hotkey-xbox-paddle-3.svg
Size 1KB
SHA256 292beb7654aeb6d34bf00ebfb02b7d60b1ab04c29c2465775fa62837558bafca
MD5 7f8f0ecccb3648c7b284c422e016c38f
SHA1 9064971e7072f2eb63cb961b67241cbfc5b4f9df
SHA512 08ca062010358014d16b7bc42379bb9d974236b4fba4efce198a0c26068c7326467c8f2ff0ca2ab702b382386af6e82cf0637776d2106b4d0d6ece8848a8d5d2
TLSH
T1DE21F3EF62C4E2D1EC06D3B4D4315B315B6B397B3B56CD4947922F14BD151A84A1FC50
MD5 SHA1 SHA512 TLSH

Submit Download

hotkey-xbox-paddle-4.svg

Path C:\Users\Admin\AppData\Local\Medal\packages\VelopackTemp\tmp_iEd8Yg7jqMV7g8kc\resources\app.asar.unpacked\src\assets\icons\standard\hotkey-xbox-paddle-4.svg
Size 907B
SHA256 220f5453101f1d76ed95903c8733dcc2ec81750587394bf72cd5528af2149e32
MD5 d04b0ab1da0d1edacdd9efcc0d9468b3
SHA1 46a09b31c7ea13bd6b7f956a959aa7209c1f653e
SHA512 5f959b021c0ef3fdc5151f524b9e50362941d1c13b3d379c891b0866261d49af761e949c36309f753419aa4f4edfafa7a66309f22e9d313dfb2aa4f46b33a28a
TLSH
T1D711C0E5C3C4E590E104A73CC175A736172324FA3B5ACE8982777712F8666BA201F585
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Medal\packages\VelopackTemp\tmp_tycyPtztILXLGGAN\LICENSE
Size 1KB
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
TLSH
T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.exe

Path C:\Users\Admin\AppData\Local\Medal\packages\VelopackTemp\tmp_tycyPtztILXLGGAN\resources\app.asar.unpacked\lib\sqlite3.exe
Size 3.6MB
SHA256 5a6cabf0f969b746e9c0634d760e97cfa64d0bc01e600b8db9e296eb86119784
MD5 c2d79bd409eabbaeea739e28d944ece2
SHA1 09de329bc0bb258437d900a7e697c8f4d9ea1daa
SHA512 d94d171d512467a605fdd63d137a2452586a20aadd62846317eb933e56b44e56d221768ab9b88e6b7484071859940793b5e220c3d2a8b90573e6409c9f910f84
SSDEEP 49152:slYBoLcLq7+Wygjinevi+dKyrYlrUjjZgCHzi6T86fpNdwAL0+:smBWxmlrUjjFtGa0+
TLSH
T16B069D57A7B8009ED1B7C17E854A4717EBB2B4051760A7DF11D486A62F23EE21EBF320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clip-preview-wip.png

Path C:\Users\Admin\AppData\Local\Medal\packages\VelopackTemp\tmp_tycyPtztILXLGGAN\resources\app.asar.unpacked\src\assets\clip-preview-wip.png
Size 1KB
SHA256 60a068eef21d56d121013b8097d931765b80703c43996036cf40489b9715cad6
MD5 8ae1f467ff93bd7e2b2533f3a8d1f835
SHA1 0304cdc6277e9e337b221b0cf3954b19d834c76c
SHA512 d5688f2f2f4591c191f8dfb51916ab4a958e0dd3f6fa4d39efc73a907bb04f76d05a1b77088d4e9e7011bbe90b641116f75e249f999bf6422b7a4697ad5fff43
TLSH
T167414C676977D9B3EEAC26663D5262993D0BB18300C20829BD3934ECC632EE111B3D13
MD5 SHA1 SHA512 TLSH

Submit Download

error.png

Path C:\Users\Admin\AppData\Local\Medal\packages\VelopackTemp\tmp_tycyPtztILXLGGAN\resources\app.asar.unpacked\src\assets\clipart\error.png
Size 5KB
SHA256 5a8fb715da60e9cb876bb64e9c82682ed89974c7b0113da7c81967dbd6aa59d4
MD5 9cb8bd78a6d636d6752c8083a7516f69
SHA1 5698f2de349ac1d3a62a1677e46a992ac93dbf87
SHA512 be35c4cfeafeef3d8eb030a12f29b896ee0b446392a8b0fe61c823331cc55c1fea5f32b5bd4e1b23871f329df0c847a51b2f455bfdfdaab26ce28bd69c518160
SSDEEP 96:smH6/9d1eNfCaGcI0P9VX9tZ0w6qim7OUxmCtS5DHTGNiy1MZFZUmmmSUtHq7mCD:sms8fvG3i9TZ9ioOU/S5DHTGNiy1M20W
TLSH
T1BBB19EDEF7F6D98DF6EE3C748F776E41612B8D12073A1187C845E60A8249A0426F7414
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MedalGameInfo.db

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\MedalGameInfo.db
Size 9.9MB
SHA256 c7ec7f479cee3f328395b4341df4fc287ccc9773ede5a787802e532fb25e4bdd
MD5 3ff40af14b755153a66031d3e27d16b8
SHA1 20c987628d18c2cbd34c1b515c041adc935a7c0b
SHA512 bdbbf16145077f358b737cf4ccb70a9be779b4572abc668c91cfe9b4d2ca901f8c2801c822528605eafc33bd62b5eec9b0ddd3c2110e117d7e0883acd81630a5
SSDEEP 196608:IpjaC1Y02pvd6pAJhTogFRzDFvc5TpdFVbgltNx:Iha6czyAvTocRzDto1gl
TLSH
T17FA633C24634B6F16AFBF685C3DD08E3B419F5AEDDA903DD8241626F849E87E01D9078
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_appid.txt

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\Plugins\CSGO\steam_appid.txt
Size 5B
SHA256 6f5ad861cd3a10dc7c3c4f8c390021152ba634ba5b10026bbed75a1d8da68563
MD5 c80df51b16a23c119e30ba27b4774760
SHA1 393d602cdbde479ac93d909393943aae4a72974f
SHA512 cae1b8375ab53b81222851fa0ca85ff7864775ec59a5fcd9113564aa04a2aac50a75b40e6ab17715e3d14f19c6437150e8ca5114854e24260b03002f9323f1e3
MD5 SHA1 SHA512

Submit Download

SteamUtils.exe.config

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\Plugins\Steam\SteamUtils.exe.config
Size 176B
SHA256 8305f905b29a9202d59bc06753ac1acc00b3b4c8b951d820ca7ac850e7a4f7cc
MD5 07c7bd25442b92d5e654d2b47ea63ec0
SHA1 4c1a65c73edf4dac58f7c6d1e0094ced79647736
SHA512 6204fb64c90537dab7f64b8d99430e8bfa7d4759bd22b2bfe7959f59beffc001cfce1e3ea80fff21deeda91cede3c48726aff7433e6a9b9e32c1f239f53b909b
TLSH
T1D1C080154098BD275D334F176361C915EBB072566464040CF41F9557073104D4247367
MD5 SHA1 SHA512 TLSH

Submit Download

angryBomb.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\angryBomb.svg
Size 1KB
SHA256 d1be1896e7844207d3dc9c49fa81d11bfcb01dda47cc4f47335b6c5b8276bab1
MD5 8ac418bd40df6453e05a9c2c74e285d8
SHA1 641ed540e521a61be75ada9ec4014059f2c96213
SHA512 4ef033940e25890499119f86582928a49f39a63acaafa370e4ceddf1fe7f44c0c6d13186fb4f744ee387149651500c333f5cfff53125f6b94bf92a4c3b8bf18d
TLSH
T154311EF3B24061B17445E771BA2CAD92C91C14F837BCCEC8D2A448F946B16DC4C9A867
MD5 SHA1 SHA512 TLSH

Submit Download

axe.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\axe.svg
Size 665B
SHA256 adbfd75f85bc696e98023af360612ab026ef81ab51bf55f160830e3cca5704f6
MD5 cd40ade46ff545aba7f0e62cf88d0d20
SHA1 f9d10cdb4b4a6d27fa27dc3c22a7e429176171ed
SHA512 b5b16efb46b807cb9936907c3d410083f954e24c6de5a8b81494f26a5d22c88d5833639b8b6571c86068f7dae8612479553fc6a97d766c9dda89cd0a39ee9d52
TLSH
T16901DD569A1639F0094683E4ED3A34A2F0798CF2D3C094C81441915DECAC2FE4CBFDDA
MD5 SHA1 SHA512 TLSH

Submit Download

barbedWire.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\barbedWire.svg
Size 1KB
SHA256 beea4d17c30a4c5ac0c96c2766690984adfc3ea2cbb2c70e681ce12d32b55298
MD5 7030b11da4a4c788e94ff969a7a7c258
SHA1 398b7e26d26ba660445af4808b983969bb71b590
SHA512 905db3b9fe3e6b9325d1e25d2117c1193e06c1363c7d9f2a75caf06481cb6c36ed4757b89a7ecb2e426fd739c67a0d503483f85bc1358a1d653817f02d9e11de
TLSH
T1732133EEC54435E0D648DF70DD2C2C33F16E7CFA9CAC01C005402546A5BA0FE5D5E868
MD5 SHA1 SHA512 TLSH

Submit Download

binoculars.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\binoculars.svg
Size 1KB
SHA256 6fb221fe8bd031586884a3c8d50c749511533f7dcb1de28c5b328d466541b2e0
MD5 1758a53d33ea824c70286067a5eccb2d
SHA1 616a673966ea58a3d93bb745cdeaa6b0e8b8e3bc
SHA512 db3a0b83ea70b951ff6018b16e17fe16837b895e9a80a4951606e7d8ec7b2227b3a5b3e9b4875a2852b5074c1c61cccbe7e88dc5b51f5c92eb3f812d7be42491
TLSH
T1AA212FF273E09C8C8A838734C3B57AD1F6AB28B84B814AB142309DD4B1629894F8DE01
MD5 SHA1 SHA512 TLSH

Submit Download

bomb.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\bomb.svg
Size 1KB
SHA256 c34b0828548e78b89ec233e32cdfed6ebeee67c3dd43903095e14954e6c05290
MD5 6bbf3231faa57b37cd85f3b9d3857c02
SHA1 583c64958b393e811c405f29ff1bbf8cdc9a0ad6
SHA512 e2e4049f008f47fc63c784b09b870da170902d9c30f0ae76f0d697a340e3e743d75dd0c38236304d78fd8934ab3766cb04d74b9bfe50bf400c43602ae58a3f5a
TLSH
T15621FDFA96A0CAD8A8C3C394CA722871D16F31F0EF648AD05090F3F53AB54C84EC2C50
MD5 SHA1 SHA512 TLSH

Submit Download

bombDrop.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\bombDrop.svg
Size 857B
SHA256 34501302731bdcf8618fa105339b59737b80221215071b77b7283219e5751896
MD5 1bf77dfd6c617599517b4dd1ba059a92
SHA1 55b4f9d3232e05d058c57e155d310649392bc2b8
SHA512 36d1e416c26f9050091f6649e2dcc231cc7bfab531efd827150c5b500398968cb92aaa54aa94a1ef2bf277bec91dd9e9fbe7b5d9390311b94bc4425611be00eb
TLSH
T1EA11CCB4468F96C8B111CF34C02E0BA7F63EB4F8ABDE9850809879A850423A55484D9A
MD5 SHA1 SHA512 TLSH

Submit Download

boxingGlove.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\boxingGlove.svg
Size 1KB
SHA256 49e992f6a4bbb52ec137b9644eb34cc0911f3ac600fbd1d0e53a36ffd31ad82f
MD5 75487725adbd958dc47e737548ae7418
SHA1 4d8efcf32328f9121514da35c4d499217d46199d
SHA512 1c2486123931ee4beeb95ba960ff6795059f3ff4bc4f0d50297cc200039cbbe74bab6e6dff926a4eff7b132050470109be11ef270c418777c11c0a41fd5f5a6a
TLSH
T19A213AD95784848C4002DBF8A86E3A98211E387DBF84CDFEC3D2669329B57FA0549987
MD5 SHA1 SHA512 TLSH

Submit Download

bullets.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\bullets.svg
Size 1KB
SHA256 0f950ef429870a0757509368e50c459fe9f2ab0424cef3caddfc59529b57bb68
MD5 ea3555dffd6e529ef8500142d972cb13
SHA1 4dbbd415381a6c5ed98064324e1ee5126efc40ea
SHA512 e53f4dfa1e38a1c8c5cc1d7a0b87a988aaabfbaa5108d7d97ebb087f497f2d264c3405511e10ba991826686e810d6b52abf7848af99ad982e91477d9360cd81f
TLSH
T157116DEE9949A9D049C0CFD4EB28F473D22AA1D6C55140C0C842B10A7CAA0FE1CE6FD9
MD5 SHA1 SHA512 TLSH

Submit Download

campfire.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\campfire.svg
Size 1KB
SHA256 132f980c21d4f8f83312c4a28a912f06564a6a4ab7b8f2acdc6d22140dffb88a
MD5 0fb441747523c7de6d19394c31cb2072
SHA1 bd0425bfcb6431412b9bcddd56852b27c77056f5
SHA512 8982751879dffcade35f83f871b3cd5ee0f497859c40153aee6ed32ee01e889c92b9a27f564a12cf65d223f3a46634173ec80defa535f553db3549764a69395f
TLSH
T1423174FF66DC75D05E87E3C5E9315430B81634FABF80C0C6C112BDD6A2921A544C5EA4
MD5 SHA1 SHA512 TLSH

Submit Download

castle.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\castle.svg
Size 766B
SHA256 f0902e3b64471f8c5df14108c22c35ee1aa4ef8f1211743ff6ca4cb90c0ccd50
MD5 d117f8a8d736a017cfd251bdefd00c18
SHA1 f55095238cb1b63048678951f3ab45eb6c23fab3
SHA512 849f96ec1d92aab57b2196a493b39b9dabea8587bbf66f3948dfae4a20280b7a7297cacaa186098f3f385666aa9686e44cb6dcfcd5bffc8d1c664d57baa34fcb
TLSH
T192019CFE1E99E5D0E44597EADB203531D0BA18F4DE15C2C862D031FAF40AD9E2D1AD4D
MD5 SHA1 SHA512 TLSH

Submit Download

coins.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\coins.svg
Size 2KB
SHA256 0384d3c1adc27bde77d514fdd71431f2d49765c18d59bf4a5714a79be438c937
MD5 8f2aedc1cbe8e19370385ad71ec07ea6
SHA1 4ca1b78db8c3aa4c1565890387a09a698b7273d3
SHA512 eda448118e7c5891e91f83701d03afb622d1d9c8a5e804e2b498bf5e3f05d7e4e384ce9b64b220f5e592befe1f325f373f6b1acf5289caaf80d2c8fc8e536abe
TLSH
T145510FFF1794BDC0EA87CFA2CF75B868965B38F85B4046C58174E8E1E36229C5D88C60
MD5 SHA1 SHA512 TLSH

Submit Download

crossbones.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\crossbones.svg
Size 1KB
SHA256 f2a10aac5d66c9d776f97ce3a5754ef1ca1bb3bc5594912a102a3448b44b8302
MD5 aad1ba2af5da8e2500aae601183cea0f
SHA1 50f88f2ae65f2e2a017822996d14cfe47424efd9
SHA512 f987d21cceb0a5bfab0da5104cbc368d3d97aacc33688527c41aed1124d0d3a4ab123dd9dd413c8241c7e10ab376d0a9e167aabd39cd26e0f448cba16740ce8f
TLSH
T1FF217BBD3299EC0C4E608738C2DBBDD6D82B95C0DA0186C5A2202E1B7C610FF545F74E
MD5 SHA1 SHA512 TLSH

Submit Download

crown.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\crown.svg
Size 1KB
SHA256 f13741967cf1833e5872d817636dbb749d5bfff295a76ab88685b960a622a463
MD5 28e5e7f047892560037a603ebd72d4f8
SHA1 dbf768e680b547f617bcbb324fe017d7414faf20
SHA512 3a0d9d134f864b167742c136b50427ca6a087aa481494092f12717bae2b3322dbd8fa90436f09d0e56af5f659f64f190270f2d8586fe41dd6391f7b4aeebf682
TLSH
T1F031CEF927B0A3C998838F3CE432BD9150873CB92C94DB4582927DF5B8957348905EFA
MD5 SHA1 SHA512 TLSH

Submit Download

deadSkull.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\deadSkull.svg
Size 1KB
SHA256 de316fe83abd7925ed93c4778f0bc289a2ae0f58597b634827158e60a848b17f
MD5 9476bbd23e3caf46c112cf0868ea1e18
SHA1 5ba5714ec88eadc1198a4658fcbe75bb8d87757b
SHA512 d8e4bec30e75047f0f30b7184da1636ed97304fd49e65cd06ff591ace492d8566f4246f699e0826ccf7bd9a1e41d256ee4c200196b00d6a8642127fee7fdd706
TLSH
T1F03104F12240D2C954899F50F832795660AE3CFAFFC6CDE8918459A1A5F02E98C88DDB
MD5 SHA1 SHA512 TLSH

Submit Download

diamond.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\diamond.svg
Size 866B
SHA256 03bb61cd142ed1ed42bc58c6aa95d3a4a9c89ddf01a5bb9b3d44b24a6f9104fb
MD5 cf88f99c616cdac695dff944c9a3dc8e
SHA1 9878585d0cdd88b4b7a24a1d442b4ee504f0e3d8
SHA512 44dd0caeb478e684a1ce0ac89514c0b87843149801f005ed2c021fadf7c1eb7d65129fe829ff81bef4b5e12940c2c15bcb8d9aaae0034ff5f2df69865bf04a4a
TLSH
T1E91152F822684DE88206C7B8E424E8EE3A7620F67FF245D492713048B440DA2AC499DD
MD5 SHA1 SHA512 TLSH

Submit Download

dollarSign.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\dollarSign.svg
Size 1KB
SHA256 a85370463fa20977a3dfe2b2cd570680f14040d172d0befd4983952731c3bebd
MD5 9a8f1a7e0077d96ad7ffa8f41f9b4542
SHA1 d13e13da00512269e6ed9ea8623c5328d92bbfa9
SHA512 31d1d767e13bcf74f33ae169fb3b7997b7a0e421760b59371c2eb30df1985f566af2c4a0f0a32fbe962252948ba5afc4c2e4b8518f358a2fae35a19bd13a3cfc
TLSH
T1F73123FE7BA8A2D4AB4ECB28D9371CB7654E28B56FC493948290D9D0F9574D84884F10
MD5 SHA1 SHA512 TLSH

Submit Download

explosion.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\explosion.svg
Size 689B
SHA256 36c0d124d9b83cd84971f2f5e39f24546ee770c6a84937d3c5b97ef3e6e803e9
MD5 33d1284d9c281d8302db590e21a302a9
SHA1 8a67aa1191126e3506dea207e2fb2558804acbbe
SHA512 da1eabd46097a66a176b17486835853286847246f59f92953ac5b3805080002c2dd12514504026e2367424fd66e337a09dfc1372623eed2e98cf95ad54cef590
TLSH
T12101FEFAE980ABD0D08BC736E527E84120463CE9BEBE21D6C140A58299570B5181E9A9
MD5 SHA1 SHA512 TLSH

Submit Download

explosion2.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\explosion2.svg
Size 1KB
SHA256 95c392cd9f6e3bbd605564b41eeada28c76870af9e827a4e1f050e57d1ee4fb2
MD5 575044a336cb8e3b2e12906c81ef1cc2
SHA1 1a76c6c41a2ccf48f2e4a23ff74370322108925a
SHA512 8ccd9e2f401e477202b45d53a18ef33fd8aec0e7b4d41a41b128cd7f28b5d1549b170cdb02082a7af16fd17e7f850aa2ed6412c3db35761ed19c56a62f9d61d8
TLSH
T1A021F4F7A72854C08C370BB6F73E06C6A17D24BA66CC43E8D14069C9BA095A90D15FD8
MD5 SHA1 SHA512 TLSH

Submit Download

f.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\f.svg
Size 207B
SHA256 3406d7e309435e0c67fe8d79ed56af4b43486ad5be8acd1a3c67d352461aad7b
MD5 d22316c06468d0bf23bae29158f3e629
SHA1 cfcecd22cdae4518bf971b623e2e2a5c47198407
SHA512 ce835a8834bd929843026054fe00cd471d1f965f9aea5b2f8bafc061c22ebfc257d86b470158bc55449cd3123fbb786ea35fef532d7364fe18e658dc3bc897f0
TLSH
T108D022B81409DD168087E27582BC24A3D2FB70CDA8CE48E0D5802367F0088C62DD623D
MD5 SHA1 SHA512 TLSH

Submit Download

fire.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\fire.svg
Size 794B
SHA256 9c44917946f5820e8279ef784e645130ac7fc6e29d852d35e15cb30ef1f7d2c4
MD5 d3049cd0fffa9b816720d95938a310b7
SHA1 567977a592dbd6a5fbfcad9976bc6b99350abf4a
SHA512 eedf98d526634e9e2df0de37abe39d38922abd5f3af05807b025efce4057b1e594506159fa2111d54e5fa690fa5b37499d9d035f375c01ff270428e28d49505e
TLSH
T1F601C2F553DD98886043CBB1DD242844B58B34B5676413F4D250ECA4FC861ED0A44D48
MD5 SHA1 SHA512 TLSH

Submit Download

fireball.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\fireball.svg
Size 2KB
SHA256 51be1950b438016c4be66d254b81a07ae1cf0ab680f75d23821327b91714b64a
MD5 21762987cf44b77cfd731537156322fb
SHA1 9d30c5629a9849c86989f0607fcc9bb6c76ffca7
SHA512 9ccfb313f53b85cd5770c4ff0a28afbe079ec5d2ffa709ed3bc886f78a60aa6e385bc51ea565fe9dca907cb672336e0ac2f96b60017e8bef24acf1d05ba0cd0d
TLSH
T1BA5173F757C8E6C0998BCFB8D4231DE6AB5F7C7ABB9642A44290DEC0A5521E4C04AC94
MD5 SHA1 SHA512 TLSH

Submit Download

fist.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\fist.svg
Size 2KB
SHA256 f50e107a051b2653f675ae60e596b1ce821ae88f184c7ae7232bd4d70def8ded
MD5 1414beacf30d364ae6ceaaae896a37cb
SHA1 633b38344898acb8670fec995b08b76baa203da8
SHA512 ae83529cd9b08cae084356d856c6ef42d812b29a6d80dcc132215333ea3577586edd5b29fc2cc71dd4c42af37b9fe41e4e4875bbc4268c4d8d7bcfee7a47c8df
TLSH
T10F41A4F612A9A1D09182CB54D83FA461C21F58F4FFC442C2C021ADE8822A2BC9D59C8D
MD5 SHA1 SHA512 TLSH

Submit Download

flag.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\flag.svg
Size 720B
SHA256 1c84daa7d8ff4dfdf5c91f1033ff957d93f0f77058c6b438b9ce0460ba63a932
MD5 835cf5330b2b9f329167b0493920968d
SHA1 7abbed71bda9d6073f958557a0e277adcdb1df8f
SHA512 8f8b41e287c6ee385d22e03780e1b329e51137c02478772139c72237579e6fb243eaefbfa72724ee58ebda3c09abea719614d4f1f0186d76ada6d17009e4b174
TLSH
T134019CED4446688444928B14FD353CB242EA74B66EF1A4C04C83F843B88DCD9D9841B4
MD5 SHA1 SHA512 TLSH

Submit Download

gasMask.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\gasMask.svg
Size 2KB
SHA256 cec8994a94d3ceafde475076e451684536777fcce2a7e607b1db2d9cd9430b52
MD5 d7d7a72b90cec1a24d194c1f18671b77
SHA1 72d55beee78b0aab3c9cfc82bf7046bbb887e3eb
SHA512 86932a5e676c44793ec8150d07ef56e1b3c676d4da5b3ec0337dcf9658de3bc729d7d42c46a7f4fd8eaff40b23f73f88a8385c1bab21613b1cfe071bab58131e
TLSH
T1034174F72781A0D09183E7F4EA358CE1AB3F3CFE7740828E82547A42B1A006ED4CA910
MD5 SHA1 SHA512 TLSH

Submit Download

ghost.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\ghost.svg
Size 830B
SHA256 c327618e85133f5516adcd708cf311655c7ce7a44c628981236164da9e7d9036
MD5 859e881f0de6e09688082de9463e3f61
SHA1 a06101e846552f75653472deaffc114b1823f4e8
SHA512 0323cabb79fe5d0e4cb1e90155d4503cbcd9871bf747d19384eb3090dc73bedb8ed62727848fc188f0d77df17369da67e147fb77e948f012a742b60421c75b62
TLSH
T1930112F60CA4C3E0714D0771C2E45CCAE82F28BCE2B80EE8939E705199D5D8A4E80C6E
MD5 SHA1 SHA512 TLSH

Submit Download

goldBricks.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\goldBricks.svg
Size 1KB
SHA256 b5d36f837080c6de64f7b627b4036da18c1dfbd365cf81a960a67211119459b1
MD5 0efbf961b7e8d8734d690969a30a129e
SHA1 140a8194a7cb4445d850738f032f1088dfbedce0
SHA512 b351a598acc8dfe1b8004b1fa477c7ba28132a6e5a6ec9186c52481abc580ecc020269025444dbdb2af27e3d6b1909339d5f735ca21a4afff34e359d3e187f0c
TLSH
T10431F0EE47EBD4D04F97CBF4960B3472E78B20B5EE9255C40822EF85A8484DC0DCE999
MD5 SHA1 SHA512 TLSH

Submit Download

graves.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\graves.svg
Size 847B
SHA256 e87b86ab404397e5d15baa5474a5466bcd0cda3684a9742841197db13663bd11
MD5 19efd481d58bb700c99445104f514ef4
SHA1 700ff6034c41b56c36f90fa743f481dfffd70174
SHA512 4fb59d8c1aa06dd6ac10ab67a02b34f74b40fda06507aea834de4905275073aaf114239b4808ea47ece317dbe9dbc6cf88b0752e3c0f554d98b9f1f3713c0f08
TLSH
T12E01ABE92A106894CEC58BB4DE2A7DCCD11EF0FCD40199C992497269A1E60AD9C45C8E
MD5 SHA1 SHA512 TLSH

Submit Download

grenade.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\grenade.svg
Size 2KB
SHA256 e9813360fb41d65d5005fb2aeb11e1b4207da21423aadad16403caff728284ff
MD5 155ccc56cf3bdecb5c81d59bd0072d9f
SHA1 ab9152c67f4cacaa6086a894c18a587f084095ff
SHA512 ae952033c81279b470e6725629f84060ece966b62c4a0f40ce361116a65fdebbf8b2e14857e11ef04fde3e879d6f02fbfdbec08b99d9dd343d78bbcd738842ab
TLSH
T12D5100E9A14466D4BB83EB64D6386862F23F64F9DF814BC40110B6C67E9A49D8CC9CC9
MD5 SHA1 SHA512 TLSH

Submit Download

gun.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\gun.svg
Size 1KB
SHA256 4c3a56f654cd1f1e49a333957e0c4047bfcfaf949b84ecea65bfd2b9c17bbbd1
MD5 b29fb1e42db0b70dacc20929a087f9d1
SHA1 c2c6918947d31ee1f1eb0ed9562a97e9cc06b27f
SHA512 f0d8e4d19fbf494551ae428fce5ef9eaa057bddcf656b26fe186bd756db0fd0329a06a5b60c68b3feb221e85f09afcdf543dcdbd87a6e4d94082d4c7abb1f8f2
TLSH
T17511E2FA5A40B68C59474735CE3C7CB2B16920F6CC9450805543E57ABCD62ED2D0ED44
MD5 SHA1 SHA512 TLSH

Submit Download

headset.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\headset.svg
Size 957B
SHA256 3ab18bb345ac3b48f94ce97981d105e18ee68b441b517cbc88d30daae2861476
MD5 39935e462116315f141a68c6aab9bceb
SHA1 0f41a172ef0d3b805a1e6c52520646755ece57c3
SHA512 aea0217737f7cb05ed63084f8aaece965963efac18c3face9caf6b5522e72781bf3da7036514294f21fe09d149fcf3dd46044dd59f44da39008b9baf0f954441
TLSH
T1551159FB3684F5D0A083C794CBBB5D0A36E03473E6CBD2D18D529F95935B4948492EE8
MD5 SHA1 SHA512 TLSH

Submit Download

heartSkull.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\heartSkull.svg
Size 1KB
SHA256 3a6d5ddbd8a086cb9a8228114e9649471157db5d5f8150b9c39a6c9693dc8069
MD5 0e15dc3360c8790499bee4d543895307
SHA1 4e6e8b3f3563c8ba07d6a6371855edf0ab752cad
SHA512 2eac6fff40b98eeda7349fa1b19173eafee6210af59dfb81038f1ea2f573749313f9f55053ea80fab1e87e5c8b20c7f4985fc80efc1e174b74fc58e686cff72a
TLSH
T10031F0E99291E5D13403BF3CDEF3248A5B7B38F64FD84AD88438DA746119664C49CDC8
MD5 SHA1 SHA512 TLSH

Submit Download

hearts.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\hearts.svg
Size 1KB
SHA256 4b341f7a5ec767caff3c723009ea138365efc42e7643308c70a3a92c1d63736d
MD5 6c312fb77cbd1ddb7192dc1292b383fe
SHA1 b01cf2a9a2d2a392228aa1eb4429d001d84afc64
SHA512 3b80c87aaf9fc53fc2d4bc1c70cb994efb88656d997c541af5bc60ad70fb18cc59cd6fdf15daee220b6af67161bd3d7ef1f2791a247867a3596ccd6cd230aa09
TLSH
T1B23133B6622088941543DFA0AC1B7848980E64F6BFC9CEFD4025ECB51B721FECCC9C81
MD5 SHA1 SHA512 TLSH

Submit Download

kiss.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\kiss.svg
Size 2KB
SHA256 0a9dc8b459e8b954f50026df9d1733b36e199b5f418dc8c47f8da9ba7bd0fd00
MD5 03d8f30020f30e02af054ef794356e23
SHA1 904ce7865172aefdeeb51dc43eda4f46ed14caa6
SHA512 65c4f6cb0e07cd768c02ad26036346c339d74d499e64575342a70fec0a6aedd2692bc356e60ab5493a923df7d1d671daed0c3d3e43564041f46758b08d8129ac
TLSH
T1BB51C6E89126B1E55E03977CED050B966E4D20BAF7EACFE94164AAC022F21F1C4C9CD0
MD5 SHA1 SHA512 TLSH

Submit Download

knife.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\knife.svg
Size 717B
SHA256 090108cc3326f9e4dfdfd95f4c3e73c05ce37e8c1b5c1883684273c5a9e9f604
MD5 31703e2aba4c985a3632999d22d2b0ee
SHA1 6cb39aa73b1329576085fedc7c08b6ddc160fb91
SHA512 b3f7c4fc54e13255531c4947e0f8a4b2b50526374a524ef4c6838708f571c40ad127442f744b9579a56abaa0ba97a4610cfbc7824f8351768b115eccc8f87420
TLSH
T17901F9F597907DE083C7C778C43568D229D6F4B73A6111CF4354A9E1E9444A74C45574
MD5 SHA1 SHA512 TLSH

Submit Download

lightning.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\lightning.svg
Size 533B
SHA256 a57536d6c7bac18a7c4248a0e9b45fb5a4db2583ea85cfbbe64051359f52bcde
MD5 5b6584ee6cf1c917bca750423be96a6f
SHA1 a1fe7a1b53b0176323b6f6fbcdbc5ada5318c764
SHA512 239c73d620a9f0df48c378b14db512ef2e361b5a0fd94b55d5f87b5ad54b4ab09daad8557458e581d6021fa232cede8f0cd2919c665768f31d1801dca6c1cfe6
TLSH
T10EF0C0EE334D81C48846CF74B5053817C0EB7CF6E9C728D980C33263E04599A1C12968
MD5 SHA1 SHA512 TLSH

Submit Download

ludicrousShot.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\ludicrousShot.svg
Size 2KB
SHA256 64235f9ae65fe71fd5fc58f9631f1616e1dd440465255e7bbb78ed391b7f20d1
MD5 30194c57bf6dfe98cbdf69c2112c2273
SHA1 c48ea40f34e9c4b85f38944278a6bf425106e0ca
SHA512 055a22907cedf997d410681fc3422ab75e9d6632de76f59904e44646e36debd3dcd38334077838078c2bb0bd51299cdab0289aff1d7a58cbdb8c6f520d455525
TLSH
T12F51EFF78549A6F0D6438F79F929FDB1C43F7CBD6EC846C402E5A5A184680ADCADD880
MD5 SHA1 SHA512 TLSH

Submit Download

magicSmoke.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\magicSmoke.svg
Size 2KB
SHA256 520b25a047d5725fe2cde275d61bc4d132d68c2f5c88f08fc3b7e0cfa94601b9
MD5 d9512e70b18a39e6b7823ec8cac1d5a4
SHA1 ed0719a273eeac693e1218b95469ac4412fa08b3
SHA512 ecb5472f18787a5cda837b4ac8111f8f9d2cf9055cec69dda82a9655f8e4e3a0bbaab4214460c863ed97e9a19672f1e4a3a7a76d7e7b7027d43d6bb439c365ae
TLSH
T1965170FFB5D462D0E80BCBE0CC275935B84E6CF6BFE647854890DE997A9109498C9C4C
MD5 SHA1 SHA512 TLSH

Submit Download

medicalCross.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\medicalCross.svg
Size 240B
SHA256 23933c381bdf0bca72e24095da4ef3f5257bb038c3d1cdf24bbcfa076b0cc07e
MD5 e91faec7a9122007f19a6ece86b16fe4
SHA1 869e08d0c0bcc8399ca0ee8d67d7ce3666c06925
SHA512 0a93b8b3252c55231aa6fcd5ef6ac3e58d85bfe5ae9c9fad8ee7df5aaf29714cda76c809fccfb435b2701bc6270957b055a524a8c1eb00cc5df11215a7d401f7
TLSH
T11BD0A7B8141DDC88A4818AB4923C26D1E07798DE64BD4199F1503117F4456FA185527D
MD5 SHA1 SHA512 TLSH

Submit Download

meteor.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\meteor.svg
Size 2KB
SHA256 b19083aa8e90b5277b542024be5d3fd7febc07e412d3bb51e3bdd98da1b55fed
MD5 cb9b412f4de7470efdee1ac14792e7d3
SHA1 b1d68dd8404ed3e58a94bd91a0ac879b5f956115
SHA512 7d646a698a45d3e2567ae970556268e5428bbd6a15f7a2bfcf4158a4d0c0bd6f9b52169e5161ebcc8fb35521ad8ba7fdb5e97855804c447e4cabd57e71ed7392
TLSH
T1924194F79380E2E49507C774DD379861F63B28FEAE1A83D00188DD64EA250D9CC8CC84
MD5 SHA1 SHA512 TLSH

Submit Download

moneyBag.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\moneyBag.svg
Size 2KB
SHA256 73e16f1e9f4d5eb4db6ef52e9a6e336f94ef2a981f804829d36e2b1e0720be42
MD5 eb3bdbceb5a240c8fd294d54870f9bb7
SHA1 8d550c75866a6fce8c17632525c237aad5ed0078
SHA512 130972c06bd6b5afdbfb189272d3a142866e4724a825fb32189bef076846b30c32a0fc33695031144bb0825bd530fd112bd87739155f16f506eb799df01c1f36
TLSH
T18C4143F61194D3E455839FB6CA3538B75DAF3CF57BC097994194FEB0A532148C88ACA0
MD5 SHA1 SHA512 TLSH

Submit Download

mushroomCloud.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\mushroomCloud.svg
Size 1KB
SHA256 848de31abc5c00d7385e99a54bcfa9bd71b132f648ad23c804fa794e425d2081
MD5 46076a5d69cb5bfb373ea9f5d8d215d9
SHA1 69e52d87d6c2b6126198f9cb71724bf27ca29e64
SHA512 3b5df24b97c953d2e58112c403437dc0c91a906517633409837be5fdc0de9c5c64e4b636343e07b43849bab19b375e6b3f6555a08c12061b7464bddbec1bc277
TLSH
T1663102FA93F4E2E4612BD712F0B62976669F14F076E84FD85100ED65E86249852C8C05
MD5 SHA1 SHA512 TLSH

Submit Download

notch.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\notch.svg
Size 1KB
SHA256 8bada3ba97a5e4929db6aaf283f2d4ac59c91aef71a4a32041bc3f7aa9176fc8
MD5 8ea5f52d21e385e45f02860d74ae064c
SHA1 ba3b501ecb0604240466a56ee0cfef6c6a1e5019
SHA512 4dcdd07e28fd5cd002ccf83ad30c8bbb6fc91b394f6d76b61789c6b5016e04c8cbe9716440ca679cc3bf88d6a12feddca51c4d6bc3a50358fc425f3c4f854ea0
TLSH
T16E21F0D667C466E8059EEBAA892F0140F06B70BD6A04B99D02C52BF8FB215FA324CC41
MD5 SHA1 SHA512 TLSH

Submit Download

numberOne.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\numberOne.svg
Size 628B
SHA256 69611a5d7ed1e0bfe2a816364978a13ec0eb0ae702e7dfbb8a368cc4b59c91c8
MD5 8d4f929cc22672cd903d666a79cc24a3
SHA1 f21083aafba80651d288ff993496cf026022e1c5
SHA512 3c3db0125cebc2cf7c9871e3036d34073fed5a9ad951ba0173ac958e563012e1bac2b811e96c38e7d30707227fc26d8caae79c0ba02c014dc252ac6fb7cfd604
TLSH
T148F002F4140088905C90B779931E3CE0F23D24A7B5B882CC8442715EFC844D5691FE18
MD5 SHA1 SHA512 TLSH

Submit Download

parachute.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\parachute.svg
Size 1KB
SHA256 7c0205f1ba98093ee83e3d62d919f051d4331a395248d52b613da724ffd935f2
MD5 a23c4366a66c728b90fec15936f91a25
SHA1 0d0319e11816ad2d0a09f87036df6ab1f0b48bc6
SHA512 3ff14926a65a529d93a2fc86376af198295f5bc0bc05fe7305953857c4990721319c9931c51d047e7b1d00adfb1acfcd5829e0313291d9adf4af8aa881469ae6
TLSH
T147118BE5F98CA0F30811E778813A9DE0BFBD247F6B84E20846A0D3E4E2051958C8AD48
MD5 SHA1 SHA512 TLSH

Submit Download

peace.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\peace.svg
Size 1KB
SHA256 1d8c3b5535c00a0e182107787d95f2607d7b271b2fe51b609088550ecc1853b5
MD5 d0aaaee27c8da347bf0036706e5a3f9f
SHA1 062daee5c4c008f2aa4f966f1f202f9fb3f2a5c4
SHA512 71a28cdec62733f5ba470f7fae6830099433bb90b49dcccaeae3be46b10050be23da48fee34f6e1a31f671c4bc88aa2bc68501ea76449e8926a214a957939cdb
TLSH
T17B3162E7B7C8E6C0C68BCB71DE362CA1991F18FBDB5912C80084BE91B94A0B5C64DD1C
MD5 SHA1 SHA512 TLSH

Submit Download

potion.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\potion.svg
Size 1KB
SHA256 3780a12caff26fe5bd601031c5958a5a88cb3ec71466a52b50707ddaa811bae0
MD5 1f652d9f3b3ce26ee1a4e1e7d478cd0f
SHA1 504cccff196616db2cbddc4fe74d727724283760
SHA512 c43c089b698793a2f006c79276ee8d0e0d71a986ab1b835dc8d0d57100deeddc58e46e27a244f1470359724ff9ee44f8f7ed23de9df80747cdc1705553ff4e56
TLSH
T11211F0F912B9E490303E87F5C838ACA97E9BEDF863541B514411EF94A6E30869FC9C04
MD5 SHA1 SHA512 TLSH

Submit Download

radioactive.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\radioactive.svg
Size 1KB
SHA256 4bb568d836a138649ba7fde3022afc965e4d660028c0cfb60066625305ec5350
MD5 36bd71aac7483d6fe6bcb821d4e7e123
SHA1 fefc370bb884e6715003aeb959c3275ab93bcefe
SHA512 e204396cec06810403fff5f989f54bd4db7e15afbedb94a9a781ac782fb7b84e1e52230db87efc389b4fd6213f0a4fe0571ace4e396b3ea1bf2ec513a17d1d42
TLSH
T15031F0EF26C5F8C0DB07E7A8CA316437A25734F97EC442A646C067E4E9452A88E4DD84
MD5 SHA1 SHA512 TLSH

Submit Download

rocket.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\rocket.svg
Size 1KB
SHA256 53e526d45ce9df12cedcdaeac1435eb545b76c9ad450ba1f3c992a427908931a
MD5 2d0a433e437fe94d82d74a4707a4ed95
SHA1 c798247c388b3ec889c6f2557d6f09fd65f4c174
SHA512 36844d7b89758148e3dfe02eb2cccfcb59ae3b2ef24bdee6fbc4c1b7248dc90eaf771bb7d9ea59798a5c4156356d580a2ca8f87cca81db33b1bd5e7e4c85b537
TLSH
T13E1146F38205F5E0CF03AB30FC1715576766347AE6D64D3140043B18F4B28F9185D886
MD5 SHA1 SHA512 TLSH

Submit Download

scroll.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\scroll.svg
Size 1KB
SHA256 cdb2197aced5037c04188947258060f4e14e9ed0ea5536fa4c280f2f4b3255f5
MD5 af5ac836ed2049ce5b0246cb62c61b50
SHA1 c7e5fd8ea479698b23c1416bcdeb0ab2658bae28
SHA512 a3218be5455fe93b4b679d59ceab0cbfeb08ef3ea2045fa753413babfe9ca9d1bf78554e7ba9d83a6de0c8f84e7548d1f014363af1b477cb317d11800280af29
TLSH
T1A83160F3C6D475E0A882E7D88A32A026A2BB74F43B3441C20620BAADE2030D9438DDC4
MD5 SHA1 SHA512 TLSH

Submit Download

sicle.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\sicle.svg
Size 869B
SHA256 975a4b7321badc857a41c346a0f9a42628140379da65ba19eee1b9ff660cc4f2
MD5 7dde658687dbdb4783253f2e72b37df5
SHA1 802e6029da52f7549a7ad586e796a4ba8f9ece55
SHA512 5a5dd945d4d8a0808f98226f84d46a6a05720cab111bfd435eef973d42d7f1a04aa34d78d71c04d42ab1913d7c2f54ca7e017afc8c296d0b2c60c6f8ef14a5c0
TLSH
T1E6112FCF8708E140F602F7F8814115F799E330F429A893518646BA1E763019A8CDEC84
MD5 SHA1 SHA512 TLSH

Submit Download

sights.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\sights.svg
Size 1KB
SHA256 e4b4e9137eb0d8dc302bee0a64ccb390b55c8bf66545c2447f7288d629dd6555
MD5 37f3d46484a7006128dda9f3a025a7f2
SHA1 56b9c1488574447c68a1bf8415550cb690660268
SHA512 e9dcff1b890069f15e03070cc4bc3c08a66459f843c9847a557a22549cc2246604f790590f3398a91b58786b01581d173f49fdf0638f4d16a19286d41ead7913
TLSH
T1F231E0F7FBE886C02AD27763C9BB7190B6560CF186578A788230E558EDE24797384C90
MD5 SHA1 SHA512 TLSH

Submit Download

siren.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\siren.svg
Size 1KB
SHA256 54e6fb1b7796fa32078dd459edccbaca834b55dda0f1122b34cf7ed5ecf11735
MD5 5f9d15a2b6f422b59763eb598e40502b
SHA1 eecac6ff4e42cc73fe10a9f1f9203cf3c53a6250
SHA512 ab3d99b06f4edd7db5aa73c0b8a8890b8a56c167ac17f7b5c541232c6b30157a310a338442da2c002673db24489fc64945f234818ffc6f040886dedfe885f2a1
TLSH
T1BC4131F993D82080C506A376ED3E6D71F20E24F977908FC042906A66F16A3DC1ACDC0B
MD5 SHA1 SHA512 TLSH

Submit Download

skull.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\skull.svg
Size 1KB
SHA256 13eb1a9724d843fb54e430e94cc5cedeff7c71b0d1f7573802efff57e00e3d26
MD5 7860a21e7de06c525059ea43d64c76f5
SHA1 7e367f85b5bedb2d623c8b04f5010667d31c32aa
SHA512 6dff1b36ee5cd1055ecee42a8bb800af8cc686e6a09ec8f9c08239ea1594773ad8605e42135154e50662b990067822bf7fc0072b196af39c240be94c7032dd2b
TLSH
T19C212EF5BA4473C48C4BC827DC367E86289A7C3777A4C04ED8B1B8FED9923A0C050169
MD5 SHA1 SHA512 TLSH

Submit Download

sleepFace.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\sleepFace.svg
Size 1KB
SHA256 dbf22dd7de9a0b581351e0eb5eee7cc78e782a6619205434baf2cc6b68a2006b
MD5 a4c95d333676fd77b1597c63b56b53eb
SHA1 40fd813e4fc6290e2d536c927aec3658d8e83fab
SHA512 6df995199475dc4cfe55846de4a31305df741e4ef2a8a2d76a403fa98e596e863b53479f4cee8668aaceaba68050f9297a55554a952441b90a571dcd7691a415
TLSH
T1E53144EA9504E7E0AD4BDF79C91F7891AD8750BFD951E9D48480FCC5D869CF90C05C88
MD5 SHA1 SHA512 TLSH

Submit Download

sleepMoon.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\sleepMoon.svg
Size 3KB
SHA256 6b7938f7c4df33a4d882efee4db02fd8302c8dac1960238b4bcd753ff90c0bba
MD5 dfdcaf65dce240952a095e59180f8179
SHA1 1cde852554c69846dad5aed115e4c97ca61e7c56
SHA512 99a34ce5635a85e3dc2346c2ab9274b764c651d0a10c47f3a05b5e459482756c1f22723e8f36301fe1d875e74a4b48a18ed526f06b42a234382241ee2ee39321
TLSH
T1A38125FBD7C872D0E447E7F1C81195A6B6A7343ABA96838402A8EE91FB520E94D4DC14
MD5 SHA1 SHA512 TLSH

Submit Download

starFlag.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\starFlag.svg
Size 509B
SHA256 fb04c462445135b4e57b056aad889e7fcf55b048fcfc4132d1d275da25561103
MD5 34b9783af6740f24c719979a0fb47a1b
SHA1 1a9d49e2171b306ca8ba5a7a07ad04405c306c49
SHA512 07b556ba84f8a31817280f3d29483f4090eb4008adeb508f6283b50e54095f1fcf71d568beb0cc6142624ba77e4cd7c2bfa916ddbd944e9522f4ef75be6135ee
TLSH
T153F09EA5046BDA5E19890A74D12C7CE1F46BA4E1D28D00A6D1C1BD5ABA5D0ED8C06D3A
MD5 SHA1 SHA512 TLSH

Submit Download

stopwatch.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\stopwatch.svg
Size 1KB
SHA256 20c54f8caa759bd84e25be91a580b4c3bc548652048cbf8c681ba09f9630eaa9
MD5 f288ee5d26f862fad8213f414048f5f4
SHA1 fd11819e741276a6a686f5fdaa0a59f6f85da696
SHA512 54aaf966e4542386d9296ed2a704897ef9bb1ff7fbc431457d0503a0f135f13149265fbae4097ccf650108000b88b4bd12fa2f512b759e118ca6c8fe60ed41b7
TLSH
T1561123F378A0A5D4B843873DBA2D6490E54F74FAAB3CA3D7919035E9F1C24D4C849C46
MD5 SHA1 SHA512 TLSH

Submit Download

sword.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\sword.svg
Size 441B
SHA256 ff5242df3fd9e87e9915a65c996fd33698a6f0ca34f923c2cdc496f182bfa305
MD5 cf64437a3f21273f35a388e896296586
SHA1 0110153de1c19a3aa9eba80162ce885b3ce9ab88
SHA512 52ec0cbc316108c8276518ce339b2f9135bd1db467028f2fd76d89e25a835993594f7178d2019db0e45bda6d58d2e36e0062c62686a76b520c76d4f5a314010f
TLSH
T155F05CBC9E89ED154996A3A2CA152625519FB0F4EF4880E48D4571436D0E8C468DE986
MD5 SHA1 SHA512 TLSH

Submit Download

target.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\target.svg
Size 1KB
SHA256 6ea4e295378dd72c9ed849dcb0add3a94f89e5bef940a9dab51e290ac0d3d8bd
MD5 728f21630f502b88f117889a312749b0
SHA1 1f902e2c62ee5fb87fd79dda874215119ed4cb4d
SHA512 b718b06c7316d6a6f442f534707a9dd6116409c4894b90e5f80ee8273872e90f08c2522a44b9cea7f551a3b52c374bbb736e63f095a1a822ca3b150d8ccd8d3c
TLSH
T1223133E5A0E8219052CBEB60EF256933F56E39F8F3FE42890468100585226BF8D868C8
MD5 SHA1 SHA512 TLSH

Submit Download

threeSkulls.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\threeSkulls.svg
Size 4KB
SHA256 05d6743d05760ff8521abbf51c1d2d2b4df804e2ad5278fdd2703b504a6ef3c5
MD5 7980a7ce69a06ac492c8a68e664e9274
SHA1 9c313f5b23541dc68b6f147d68ad5e58de5c576e
SHA512 ae714d62972fa3ba61fded2d21edc9983142defb52b10ad34f0f6426a1babee6431bcc7e2bc7a5559557c27d9f76b5f0a1bcfe7c3bec651c1be10f33edda71f7
SSDEEP 96:nZZC0gDlRMDxdHBlLxHJp1M786RdJlq6SQh5:nZw3DlKDxdHBftiZPSQh5
TLSH
T1B89141E257C816EF17878B90C921B871F76A38B5FFE4BB69007099EAF025354980CCA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tombstone.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\tombstone.svg
Size 1KB
SHA256 1523a645a08af981371ed95f9f71e37c78c4f0e2ca8141804795429697662486
MD5 476f29ad51c6ee27e8cb85145a1355e8
SHA1 3a6576976f091555bcc711909bf642c08553f9cd
SHA512 c2e2e8e50ffd6764c9f0dae7de420317544311a3508a6f83c2a4163daee49db7373a73522aafcc6c461c2ff1f4c3265e6053f745ca015f55556a8183b0cdd877
TLSH
T15A2112F840A0A65185978B7AFB387E77979F14F8A64500D48050E7E9748A2ED9CC5D41
MD5 SHA1 SHA512 TLSH

Submit Download

ufo.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\ufo.svg
Size 1KB
SHA256 6dfb05e1c9ad490effd3fbf4c5e7e050655c13eb64b0a3cdebec57c50b9ea123
MD5 2ffc6a29b3aeb369e284599780d3f764
SHA1 6a6ac2fa5db80411085c3bfff205e3cb5d42a085
SHA512 f995c1f160caeb95b1bd99508b2ff2340e976e779efad15d937d092bb067598ea23b24e14478911b564a01b0cd3f9b41d0591e6bbceecd96a7774494ec15428f
TLSH
T1953124FEA05034F48087AB99D5271EA2F2477CBA7B8BC25C41807DD4911D0AC48CEE80
MD5 SHA1 SHA512 TLSH

Submit Download

vikingHelmet.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\vikingHelmet.svg
Size 1KB
SHA256 fb18c0059c06d42d9a6e2f67dc2c445374bb847d675a91fe64628f35a108ab23
MD5 70bc04650b5fe3d92ef32733f294af54
SHA1 d53f7d30c206ef8f22cb04b4601deaddb6954247
SHA512 e119a1a2d2200a7ee0bd4965fc186616d63c21cc1254fe3a2a3371ffc8f11b7db2e57c98817a7a158823512caca270dcea05388a8ea0aa1b3e6427335b8781cd
TLSH
T12421E4FB064456A04D46CF5562BF7CBBA61378FB9D7311C50022FAA6A1430858C8AD84
MD5 SHA1 SHA512 TLSH

Submit Download

wing.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\wing.svg
Size 1KB
SHA256 288446e3059cf46f8c12121e1f5d2232ffec346b359d7ed7020dc08c8835561c
MD5 f4b55f0f1334383e55810be73473b0ea
SHA1 b43643e0330ac1d334c8498dc8b3272bb908c4c8
SHA512 870a210c6f7aac48f4a2f6d4740e32961ec06d406f565c7c763e93cecc1dc4ff6dd63defa8be87a9385015f2140aeebc8541510e3f768550aaa9e5aedcf6845e
TLSH
T1ED21FEFE45DCE0F4A842E7E88D29E471F5EE14FCEFD443A846107DB661066BC988AD90
MD5 SHA1 SHA512 TLSH

Submit Download

wizardHat.svg

Path C:\Users\Admin\AppData\Local\Medal\recorder-2646.3506.1\resources\app\src\assets\icons\icymi\wizardHat.svg
Size 2KB
SHA256 44739455d18dc22e87d1c37c144414719a21fc49a4066c6ceebc5e0334032b2f
MD5 7b5bcc544d875e20a02e3f2392cd5358
SHA1 e1ac71dcdfb8bc810811aa58e739148bd7e3da38
SHA512 d24968f6b8155d6d7e362589c6b7f08f52680303e70870747bb31f5976410adba11f56f952cda6ca19ab8e44f087cbf65cf072e792e6de4c82cf8fbedbfc398c
TLSH
T1275116DF8588B2E0B646D3F184216E767BE730FEB72A874902D06DD8E652124C94ECE0
MD5 SHA1 SHA512 TLSH

Submit Download

recorder-data.json_50c21342-e843-48d4-84ac-6b1b22279f6d

Path C:\Users\Admin\AppData\Local\Medal\recorder-data.json_50c21342-e843-48d4-84ac-6b1b22279f6d
Size 31B
SHA256 fe6db77f3c88192664f6a90bfb0db387e96b1b117759f8babcfc9caf991fb575
MD5 d0fda3033a603efa2aee654d767eb392
SHA1 e51723deac0e7c6c56a84cbf1ed2d47b64674e0b
SHA512 67bac399bfa8e7d31f245e8d57f26a002acbb4d570fe28e494af3427d5841279ce59cc7d1745c41a58b1dbaaae9b2b845dd0f8a4e541132c231037b263ba1b69
MD5 SHA1 SHA512

Submit Download

setup-attribution.txt

Path C:\Users\Admin\AppData\Local\Medal\setup-attribution.txt
Size 24B
SHA256 614990e85f80ad7bfdc5d3ec2256b06c796e007002b4427c9e0cea2d5a2f5b85
MD5 5040cfe05304d5a7469219331f15a2e5
SHA1 dceaadd9f5405f581aca3e32846446ba195ef1ee
SHA512 b5db3963bb8b8de244800b78e3f4af2852f79b49809e8d2b2cbddd0b9c82d261296dacc44b5ec8484cbafd48f89f3e133625b9631906006d59ab82780b1bdec0
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_53ud03sg.kn3.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_53ud03sg.kn3.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

velopack_Medal.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_Medal.log
Size 10KB
SHA256 9266e084c0c562bbd71b3ad435c18a74752465a31d136d3f0259e3beaf5406c7
MD5 501964fe5d33a3b87b68c68b7113c479
SHA1 9bb191ea3bd968484bda39bd55c1c8d0eff011fc
SHA512 6cabb6b0645945d9e638d23441e90ef1c1df04ee9465955d295682481ff1e6d2f76b90d1b60847d20e36c0c398a9638ab8727e46e92ab5228e5d987e124d0065
SSDEEP 192:a9ZXE5Nb4xbGMJjea+vKqYC1PGKv4PI9W4mfVHGWm:a9y5F4xbGMJjea+vKqYChGKv4PI9W4m8
TLSH
T11F220FD4B4C9F774E80A0F5F31A1A50E41E814ED3EC16F6A571A86842EF6C86677F039
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack_Medal.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_Medal.log
Size 13KB
SHA256 845bd0abb6a2c23139dc608f144ed3f2c1131027d3cbf6fbfdd445abcfb74029
MD5 d17ef6e89bace1f051a9f8eded793611
SHA1 6284146753d1cc55b44846502bb9344f1798bc9c
SHA512 671e42209a6178b76bc89040b2325dec7ca39dc06142d9ae001271d26bbdccdea05166f20ea8da9545a8410c6a418dd03364718974f2a15fc2791dfcbd5eb911
SSDEEP 384:a9y5F4xbGMJjea+vKqYChGKv4PI9W4mfVvA:a9y5mbjeaqb5hJv4PI9W4mfVY
TLSH
T1BF5210C4B4CDF775E8050F5F31E1A54E45E814EC3EC46F69472A86842EA6C866BBF03A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack_Medal.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_Medal.log
Size 1KB
SHA256 c87cf80cdacadc65d1336747d9ef03ca4b28985c9a524bb94f566e49a8ad424c
MD5 b4ce6eb8cc9d5eecff11e4016f7ca0cc
SHA1 40ee72132b2c483035bdd20deb604be790292cdf
SHA512 ff1f14731916e520e5064ec8e7d9b1e6e354fc11c43e2fc5ff0df7c56d00ea4f35a5f6ae17b446ce3b21a1b8b6117455297b697a7d8df79882de97ad85a3c0e9
TLSH
T1C811290531CAB2BEE9088F5F32D09B5D84D824E33FC5BE66872647442E9798977AE031
MD5 SHA1 SHA512 TLSH

Submit Download

velopack_Medal.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_Medal.log
Size 3KB
SHA256 6a7a194011a16d0b6efd7a7b991bfa37a2a9d07e20c92cc031b4b254ae6c572f
MD5 ffe4d0add803a208278b8241e526287d
SHA1 efb9a09f63e9dd15a460233f173ed292b2149497
SHA512 491645ee0e521551f66abf58e1100602309b4c4434063dc0135f7a020b1c679923f8a4c504a11766cb23940853d0deae594385750fc206faa884c2ef968d1918
TLSH
T10D81DE44B1CDF6BCF8084F5F72A0464D44D854E63ED0BE278B2696482EB684A77AF438
MD5 SHA1 SHA512 TLSH

Submit Download

velopack_Medal.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_Medal.log
Size 8KB
SHA256 f0680f8eab8f3d13d119f30057b9118124d93f3e763d32a1e13cb2f1a13749fe
MD5 bdc3bf2c28b6c4bdc703e18a172a543c
SHA1 5a14e5a49e64a5e7b33091ebbb26a07f186a91a2
SHA512 1b305fb4ef66c9375533f22c3418d72c9b5ef42e08d48d24cb3510c5558ba2d0498aa0b0ae0034c6679af2a95f1405a8cac38d4f6b9d54c8f4a0cf651fbdbd13
SSDEEP 96:a9ZWXuF745NW3CnFijld/FgJyF5AlHMJjlwa+HLjKqbt2bsJ1PfBy+8hkfCdp+6I:a9ZXE5Nb4xbGMJjea+vKqYC1PGKr
TLSH
T150021F94B4CDF774E8090F5F32A1A54E40D810ED3EC16F6A971A86842EF6C8A776F439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\Users\Admin\AppData\Roaming\Medal\.logs\install.log
Size 917B
SHA256 5200f3f4126146468a7cbde0e73a220986446844397aac7a680ab8fbd009252a
MD5 b14ae614f0c730629507e454f1a166c1
SHA1 6d398729e655b198bb54ba3e245d2f998dd09677
SHA512 3f51a90d2598f1896355d2255b11283838ca63416d6c598a1e215989d00b515d1374348b127d95a3048de959f810e119e3070dc056c10d033075dfa979c807a4
TLSH
T197113A5C61625BB43816A723692B05B42F7C21B916DE0B83606EA1250C670B706DFEBF
MD5 SHA1 SHA512 TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Roaming\Medal\Cache\Cache_Data\f_000003
Size 185KB
SHA256 a228ab3394e46eb908767a44ad2c0eabab9eaa1a4a16b4e37cd1aa1819c07130
MD5 3086193738c7e67c74fd666059d6eea3
SHA1 6ded8dbcf9066cdb35248f700ab1fd000edc3803
SHA512 633edc6e3a78e17fa4c04b6d897c23bde679e4f81fef84b62542927f8d0871b7c254dc2ead9d0ff2d6b431ba4c43737c9635f3e8090d976222b8ab63ec03f295
SSDEEP 3072:P6vuiGGPhJu/qUg8VVZMVHnzTtAmQHp6V06h8ga7u0rKrx3ZnJ20XO+91GtU3D:P6vuSZJCMmMJzxA1Hp4zVay5r5ZnJ2SV
TLSH
T1570412A487ED9DA2DF731F32F1DA9B383B160F5F21651646727BA4E10403229E891F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Roaming\Medal\Cache\Cache_Data\f_000004
Size 225KB
SHA256 c89d45ac1f74fa4923f2179bbc47a47e40269684de4065d80c452ff237e296cf
MD5 3f26ab7ea9345bebb5359cea55e9d4bb
SHA1 ed2fc255fd7713578edc0c0640f13960fb8b501c
SHA512 b34069272e2d6cb3b200b6b4539c3cc4832d4ebcd953778ed502d4a1cbb1a9fd9f296e43a9a2394d6bb704192aead7a5283d851a327b13c76a4fc5a4aacdbf8d
SSDEEP 6144:o3W556ICCFBp5bQLyvdrkq17hccAq8fD8hzfYN/:o3WH6IC+NQLArkqth/8whwN/
TLSH
T1493422AF6A8EF5C39EEF09333B36439EB63C0C7604AAE51D448B15B88F2165FC454661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Roaming\Medal\Cache\Cache_Data\f_000005
Size 268KB
SHA256 57b414967a29297e9e175217c315c82f5a742c4d0cfecf3cfb8a23aaefdc9766
MD5 3de4de5eb36bc01fcd177647eed91d43
SHA1 0c369e8d6d6df5f5efeaa9728501ad5684233f04
SHA512 ad31a1ca69f28942dfbdcc85c271ddc7f6932db03914b030d11ed033e03df599be9aec8a4b3b90ee1a025bde31ff8d7e1e933317bec0a0a90408274a45342cc7
SSDEEP 6144:bvRjZiaH/k1TmLSaTF38XrTRPdDAsgHiBe94n2HmhOMy2:rJeaR3OdDcJ9shOMy2
TLSH
T11544125A4329B0A6CF138C78640F17A92761C24748FE2AA9D55CF59EFE1B373422D9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot.baf

Path C:\Users\Admin\AppData\Roaming\Medal\Cache\No_Vary_Search\snapshot.baf
Size 20B
SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
MD5 7177cd1b3e21f48a23cb47dc11b36f7b
SHA1 9e1086a6c2296b41c004834f7521790bb2941d67
SHA512 e7e8b2204e455f6e7fa5a2239cbb4c0c506562d30184fb07d63f8544cd0249226bd3d7d399ef0b69774e72afe100f9858da527b0e15a7bd3c35782d7513eff23
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Medal\Crashpad\settings.dat
Size 40B
SHA256 7b0f47c57607f53b241ac0610884db96e5cda132bc612ef6e7fe1442861419a7
MD5 2c7ab42d5171d395bad8409a512342a4
SHA1 eb46c03a5d60c82851fb8ecac40e70833a92bc43
SHA512 efe90f598136c57f98699799149ec2dac3d7c4d9308f20441049d18bb3c717e3c60aa45520aacb0aabe493398cd721ac2da5c73f75d12c3c589ad3fa74dc71da
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Medal\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Medal\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Medal\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Medal\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Medal\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State010ebbdb-01f9-4fd0-a205-e0dbefcd3315.tmp

Path C:\Users\Admin\AppData\Roaming\Medal\Network\Network Persistent State010ebbdb-01f9-4fd0-a205-e0dbefcd3315.tmp
Size 1KB
SHA256 e541b51ab8845591ad684597b9ebac87d50df1038a15fc7ee2d47e0e75bd92aa
MD5 cbcf12d0f69b15d876b034e492208bc3
SHA1 a5f4e46694c6fa0ecdfd4fd11208061c163a4f96
SHA512 07a0301c256646131716b05eccd9cb8f4fdd59e05fade6bcdf8b6c2db98bb9b7b44e3772f1cac498e6a76798ecf1bd59c919218662a0186b8ea39ca030d8aeaf
TLSH
T1E131EDDAC7DC452EC8A667F52F243923C0BE1A2C421C3D4388E9EF8E97F1432921194D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State0e829d8a-be41-4306-a88e-355aa887bd03.tmp

Path C:\Users\Admin\AppData\Roaming\Medal\Network\Network Persistent State0e829d8a-be41-4306-a88e-355aa887bd03.tmp
Size 709B
SHA256 ada0c3ebbf607019ba8f62fde4af21ff57c168d9b5bf38d074d9419df692e27c
MD5 a751850d15f7993683ff9fa6337e6a48
SHA1 f04eeda8c2213e13e43b2742ad559035003359b6
SHA512 d57e6a8048a5fdcf748322448cb32891d2ca15ccf1aa2a84a5a5f118c843b913437888e9e43e35a575f71d2f0a2371dd568d47fe70d18c01f3178d21337d8a59
TLSH
T196017BE6C7E8457E8A5657F01E283A63C5AE1A18161C3D068AD8AF4E9BF5835960044E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State75c7b1d8-42d5-4208-813b-e507800a90d6.tmp

Path C:\Users\Admin\AppData\Roaming\Medal\Network\Network Persistent State75c7b1d8-42d5-4208-813b-e507800a90d6.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State89ef9acc-8b0a-421f-83ba-6ed4978842be.tmp

Path C:\Users\Admin\AppData\Roaming\Medal\Partitions\ads\Network\Network Persistent State89ef9acc-8b0a-421f-83ba-6ed4978842be.tmp
Size 484B
SHA256 a7a840ecc8786ad9b78edeea08a77b045d77c28fc1e1f5d74d4179f3b9880b65
MD5 69a6de34e2749508167ef32470a88f3f
SHA1 b30ba622d8c73dbb9028af6d364edeaef721f44d
SHA512 0e8f43ebaafb883f327546720a4742673a13c5e083c0d71d18f24c9adbfb373e0e2d89a88ca9dc5efed34b8554ad991bab8d55d85aa3dd117d22f157ecbdcbb0
TLSH
T175F0D497C3D4997D8A4143F51B283923C1FD1A05521C3D07C5D8BB1E57F5878960044E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent Statef9e06226-e81f-4780-99e9-91d998cc309a.tmp

Path C:\Users\Admin\AppData\Roaming\Medal\Partitions\ads\Network\Network Persistent Statef9e06226-e81f-4780-99e9-91d998cc309a.tmp
Size 748B
SHA256 5cea4e1c8cec3db35818fc8499586cc779185bdbfb5fd8ad8ffa6f3933e0b7e9
MD5 0fe9ad74bdb210ba872e01b91656290b
SHA1 83bfdfdf1497f2f168312abc40ae53c9a8aaf611
SHA512 41884caafe7ac32d53614a02d87e423130975cb2c62da4d066f2b5d5fd48d4fab102ca3c18a296c26f41ee96ccb7c43d630799042e2b061b4e99b4bed5e4dda3
TLSH
T1A401C096C3D8867E89961BF01F287523C16E2B1C421D3D07CADEEB8E97F143AD51194E
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Medal\Partitions\embedded-page\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Medal\Partitions\embedded-page\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 e2e99891688414873b382d92f4cec3e455bd070b128c158eb06c07be7c998d2d
MD5 1968aab7edfe65013b627d7b3dff68e2
SHA1 37a9f8e451300756730c4a9fec392a832f80020a
SHA512 a07d53a44bcd0c867a599233a80a61fa7ec2f42c4eaedadd328e844a110591135766a3d2393d37317a0b2c09969fd8e13971b79c51dc309aa67912ae0496a9aa
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Medal\Partitions\embedded-page\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent Statece2b2e38-e5d3-4d13-916a-ae04e5ba71e3.tmp

Path C:\Users\Admin\AppData\Roaming\Medal\Partitions\embedded-page\Network\Network Persistent Statece2b2e38-e5d3-4d13-916a-ae04e5ba71e3.tmp
Size 748B
SHA256 74b575101348b78d74478cfeec46845adfa7369c35aecb1e1e7c9bb1c66ff0a7
MD5 0594c9567f992493446ecee91a189f0f
SHA1 4ddda1066d576a41657c1973ac1c472c947b817a
SHA512 cb1eb6c4df29532d1dc59954e1e6332897ef52f2ee52c511c6f845e57f5d50513a272e8158dc48c8b013e2c629d394fd9a1a7d3059206c298a9e6b887ce83a5d
TLSH
T16301C09AC3D8857E89965BF01F287923C16E1B1C411D3E078ADEEF8E97F1436D51184E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent Statee1604e67-b5c5-451d-994d-83bfdea8887c.tmp

Path C:\Users\Admin\AppData\Roaming\Medal\Partitions\embedded-page\Network\Network Persistent Statee1604e67-b5c5-451d-994d-83bfdea8887c.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent Statefced2314-bb7f-4fb8-95d3-2c70d8326e85.tmp

Path C:\Users\Admin\AppData\Roaming\Medal\Partitions\embedded-page\Network\Network Persistent Statefced2314-bb7f-4fb8-95d3-2c70d8326e85.tmp
Size 484B
SHA256 cb99dd860777334c68bd434d0b3d86dd58bb18c2d9e1ff2884090224f6d7ae5a
MD5 d9f4a579743860b14306c8658512b142
SHA1 519d32e199356b06c55237b4325f76ca833eef34
SHA512 dab8297ccc031b1911bb7006185ac4b981305bc5b0a735573d14fcafb024ed86214395a1e91aa24fdf4fcb4109f26a86f3e74a20d0313dcd61a5782220155f33
TLSH
T1CDF0D497C3D4997D8A4587F42B283923C1FD1A05521C3D0BC6D8EB0E53B58789A0044E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferencesb60b1580-634e-4de7-b39e-2ec188ce7f85.tmp

Path C:\Users\Admin\AppData\Roaming\Medal\Partitions\embedded-page\Preferencesb60b1580-634e-4de7-b39e-2ec188ce7f85.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.3d3e2879

Path C:\Users\Admin\AppData\Roaming\Medal\store\store.json.3d3e2879
Size 18KB
SHA256 3093723459d1d4b01fbb406e1cd951d767e37b5d00f3da7e8fec82173a0b5940
MD5 e2d04425fb06ba30c30084618e69abef
SHA1 0c64647a9aa91d37266b035fa95cad5f1ec6d3e3
SHA512 5fef50bb0c958be6ab293dc64c8feb87e7f7d35f92e3c6ba200cdf03696500527768e36b7ed1eadce6e2a20ca8ae289e786089b0a55a07b069e07348d643ee3e
SSDEEP 384:bxg74OIlJ7sbv044OIgRJ7sbv6zAO0MJ3svkVtJOCzRJ7swvc:bxgMOOy0XOnjy6UOp7VDO8jRc
TLSH
T15782832C99083579C6D6D335ED557F130FBC68332408286EB1DC86AC69FB1D7226B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

MedalLog20261113.txt

Path C:\Users\Admin\Documents\Medal\MedalLog20261113.txt
Size 534B
SHA256 21d5b74f256ec6bc82ecd900b141c872b8fa893ca8a73738a025b44c0649b208
MD5 4a715aa46311553c4aed3488df6d422d
SHA1 8b5c24314dcbfd43127598d61782e7d8c47d850b
SHA512 0067faebe40d05e9d120f24b999498185309d9e47d70c83acbf3c1c6ce2ff99880db0aa47518a4abd219e2434e0b8b90bc26cec630f0442bfa7773e5e549a75b
TLSH
T188F0C0163079C00909B85E27F02240D5363C935066C878122DE470CB75A473F87E9C06
MD5 SHA1 SHA512 TLSH

Submit Download

MedalLog20261113.txt

Path C:\Users\Admin\Documents\Medal\MedalLog20261113.txt
Size 1KB
SHA256 5b3b94aff01d24ae148e64af7d4a4de3a7ec7277e7e3db465de8db03749b2bc5
MD5 05452d2d45c35a3d6f5d3a0a9783344f
SHA1 7d74305cd51762f00e130a736a67fbaf944d127e
SHA512 4d1ddf723a446d458093f3e17361e2708fab67f93069ea6eb9ebb2415dc384b4509f6d08125492f12c5396af0a5773b36738e03887ebaae6fff9b83f48283006
TLSH
T1E731AF23546AB1029C745F23807350CA3B3D73D5F2CA74DA7EFE644A15A235743D5E11
MD5 SHA1 SHA512 TLSH

Submit Download

MedalLog20261113.txt

Path C:\Users\Admin\Documents\Medal\MedalLog20261113.txt
Size 3KB
SHA256 357b0598884197e4a734c1f42482b877f041dedb6cf74dee24dccca37b86f9b1
MD5 3c969ddfe9940cdc21f67a4e3e6d3a5c
SHA1 9ca0d661ac8ed110502ae2221737a0a124bc1289
SHA512 afd7f39771ae27578b17907582f349dcd4dcebd643d6599dfb5588a3cfa5f668bf2448faa8b15e401a0dc7d0d68cb80131551c16307628c6d84fb8c418e3e7fb
TLSH
T19D81ED2718AEF146AC359A634033A0DA373E77D8F28934DEBEFA644E255235383D1E11
MD5 SHA1 SHA512 TLSH

Submit Download

MedalLog20261113.txt

Path C:\Users\Admin\Documents\Medal\MedalLog20261113.txt
Size 36KB
SHA256 0ece9c5ab462282083f6c073158038e5bdf15a32b1a8118ef57a2c630b3ea885
MD5 f1102dccd9ed11daae08a4a954e2783f
SHA1 979d6f0f9f3db0ea613de05d89eb9e99003a901d
SHA512 346543b0063724ac62b5dbd35d4d6671d68f671115c9a944e21cdaca2899de621107fea68ca0d28e1f23d76d4657002bc844f66b889d5745c38d24cce67a5a7a
SSDEEP 384:QSAOL6xNSs6Cx8c5gTHk6kkPS2PcEih8zA85d9qH1cQgT0Hv8msdXN0ho:QSATSZCxdyfiezAxyB
TLSH
T179F23A0A1C5B6CDA1562D170D6162E07572C88B7BCD53CACF60EED4820AFAFE6119D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-568-0x00007FFBD30E0000-0x00007FFBD30E1000-memory.dmp

Download

memory/1524-569-0x00007FFBD2D50000-0x00007FFBD2D51000-memory.dmp

Download

memory/2304-1399-0x00007FFBD2D50000-0x00007FFBD2D51000-memory.dmp

Download

memory/2304-1398-0x00007FFBD30E0000-0x00007FFBD30E1000-memory.dmp

Download

memory/2824-563-0x000002046F5F0000-0x000002046F5FA000-memory.dmp

Download

memory/2824-561-0x000002046F600000-0x000002046F61E000-memory.dmp

Download

memory/2824-564-0x000002046FB70000-0x000002046FB9A000-memory.dmp

Download

memory/2824-562-0x000002046F930000-0x000002046F9E2000-memory.dmp

Download

memory/2824-565-0x000002046FB70000-0x000002046FB94000-memory.dmp

Download

memory/2824-550-0x000002046F570000-0x000002046F592000-memory.dmp

Download

memory/4164-2437-0x0000024CAAE90000-0x0000024CAAECA000-memory.dmp

Download

memory/4164-2491-0x0000024CAB210000-0x0000024CAB24E000-memory.dmp

Download

memory/4164-2417-0x0000024CAAA00000-0x0000024CAAAC2000-memory.dmp

Download

memory/4164-2418-0x0000024CA9830000-0x0000024CA9846000-memory.dmp

Download

memory/4164-2419-0x0000024CA9320000-0x0000024CA9328000-memory.dmp

Download

memory/4164-2421-0x0000024CA9640000-0x0000024CA964A000-memory.dmp

Download

memory/4164-2422-0x0000024CA9810000-0x0000024CA981A000-memory.dmp

Download

memory/4164-2423-0x0000024CA9870000-0x0000024CA988A000-memory.dmp

Download

memory/4164-2424-0x0000024CAA950000-0x0000024CAA970000-memory.dmp

Download

memory/4164-2425-0x0000024CAA9C0000-0x0000024CAA9CA000-memory.dmp

Download

memory/4164-2415-0x0000024CA9300000-0x0000024CA930A000-memory.dmp

Download

memory/4164-2433-0x0000024CAAE10000-0x0000024CAAE4E000-memory.dmp

Download

memory/4164-2434-0x0000024CAB380000-0x0000024CAB8A8000-memory.dmp

Download

memory/4164-2435-0x0000024CA98B0000-0x0000024CA98C8000-memory.dmp

Download

memory/4164-2414-0x0000024CA97D0000-0x0000024CA97F8000-memory.dmp

Download

memory/4164-2438-0x0000024CAAF20000-0x0000024CAAF66000-memory.dmp

Download

memory/4164-2439-0x0000024CAA930000-0x0000024CAA94A000-memory.dmp

Download

memory/4164-2440-0x0000024CAAE50000-0x0000024CAAE80000-memory.dmp

Download

memory/4164-2441-0x0000024CA98A0000-0x0000024CA98B0000-memory.dmp

Download

memory/4164-2442-0x0000024CAA970000-0x0000024CAA97C000-memory.dmp

Download

memory/4164-2443-0x0000024CAAED0000-0x0000024CAAEE4000-memory.dmp

Download

memory/4164-2444-0x0000024CAAEF0000-0x0000024CAAF04000-memory.dmp

Download

memory/4164-2445-0x0000024CA9890000-0x0000024CA989C000-memory.dmp

Download

memory/4164-2446-0x0000024CAAF70000-0x0000024CAAF8C000-memory.dmp

Download

memory/4164-2447-0x0000024CAA9B0000-0x0000024CAA9C0000-memory.dmp

Download

memory/4164-2448-0x0000024CAA9D0000-0x0000024CAA9DA000-memory.dmp

Download

memory/4164-2449-0x0000024CAA9E0000-0x0000024CAA9F0000-memory.dmp

Download

memory/4164-2450-0x0000024CAB010000-0x0000024CAB02E000-memory.dmp

Download

memory/4164-2413-0x0000024CA9770000-0x0000024CA9786000-memory.dmp

Download

memory/4164-2412-0x0000024CA9750000-0x0000024CA9762000-memory.dmp

Download

memory/4164-2479-0x0000024CAB120000-0x0000024CAB14A000-memory.dmp

Download

memory/4164-2480-0x0000024CAB150000-0x0000024CAB1CA000-memory.dmp

Download

memory/4164-2484-0x0000024CAB0D0000-0x0000024CAB112000-memory.dmp

Download

memory/4164-2487-0x0000024CAEFA0000-0x0000024CAF5B8000-memory.dmp

Download

memory/4164-2488-0x0000024CAB250000-0x0000024CAB2C6000-memory.dmp

Download

memory/4164-2489-0x0000024CAB080000-0x0000024CAB08E000-memory.dmp

Download

memory/4164-2490-0x0000024CAB2D0000-0x0000024CAB342000-memory.dmp

Download

memory/4164-2416-0x0000024CA9310000-0x0000024CA931A000-memory.dmp

Download

memory/4164-2494-0x0000024CAB0B0000-0x0000024CAB0C2000-memory.dmp

Download

memory/4164-2496-0x0000024CAEA10000-0x0000024CAEA92000-memory.dmp

Download

memory/4164-2411-0x0000024CA9790000-0x0000024CA97C2000-memory.dmp

Download

memory/4164-2406-0x0000024CA9660000-0x0000024CA9712000-memory.dmp

Download

memory/4164-2534-0x0000024CAB1F0000-0x0000024CAB1F8000-memory.dmp

Download

memory/4164-2533-0x0000024CAB1D0000-0x0000024CAB1DA000-memory.dmp

Download

memory/4164-2532-0x0000024CAB350000-0x0000024CAB37A000-memory.dmp

Download

memory/4164-2404-0x0000024C90A20000-0x0000024C90A40000-memory.dmp

Download

memory/4164-2553-0x0000024CAE9B0000-0x0000024CAE9DC000-memory.dmp

Download

memory/4164-2554-0x0000024CAEF00000-0x0000024CAEF4A000-memory.dmp

Download

memory/4164-2573-0x0000024CAEAF0000-0x0000024CAEB3C000-memory.dmp

Download

memory/4164-2405-0x0000024C90A40000-0x0000024C90A5A000-memory.dmp

Download

memory/4164-2403-0x0000024CA9270000-0x0000024CA92AE000-memory.dmp

Download

memory/4164-2595-0x0000024CAEC40000-0x0000024CAEC8C000-memory.dmp

Download

memory/4164-2596-0x0000024CAED10000-0x0000024CAED82000-memory.dmp

Download

memory/4164-2597-0x0000024CAEAA0000-0x0000024CAEACC000-memory.dmp

Download

memory/4164-2598-0x0000024CAE9F0000-0x0000024CAEA00000-memory.dmp

Download

memory/4164-2599-0x0000024CAEA00000-0x0000024CAEA08000-memory.dmp

Download

memory/4164-2611-0x0000024CAEC90000-0x0000024CAECA8000-memory.dmp

Download

memory/4164-2612-0x0000024CAECE0000-0x0000024CAED02000-memory.dmp

Download

memory/4164-2613-0x0000024CAECB0000-0x0000024CAECB8000-memory.dmp

Download

memory/4164-2614-0x0000024CAED90000-0x0000024CAEDAC000-memory.dmp

Download

memory/4164-2615-0x0000024CAEEB0000-0x0000024CAEEC4000-memory.dmp

Download

memory/4164-2616-0x0000024CAF5C0000-0x0000024CAF5F2000-memory.dmp

Download

memory/4164-2618-0x0000024CAECC0000-0x0000024CAECC8000-memory.dmp

Download

memory/4164-2619-0x0000024CAECD0000-0x0000024CAECD8000-memory.dmp

Download

memory/4164-2620-0x0000024CAEED0000-0x0000024CAEED8000-memory.dmp

Download

memory/4164-2402-0x0000024CA9330000-0x0000024CA93F0000-memory.dmp

Download

memory/4164-2652-0x00007FFBC9810000-0x00007FFBC9837000-memory.dmp

Download

memory/4164-2651-0x00007FFBA07F0000-0x00007FFBA1ACA000-memory.dmp

Download

memory/4164-2650-0x00007FFBAAC40000-0x00007FFBAB063000-memory.dmp

Download

memory/4164-2653-0x00007FFB9E780000-0x00007FFB9FA12000-memory.dmp

Download

memory/4164-2658-0x0000024CAEF50000-0x0000024CAEF64000-memory.dmp

Download

memory/4164-2401-0x0000024CA98D0000-0x0000024CA9F28000-memory.dmp

Download

memory/4164-2400-0x0000024C8ED00000-0x0000024C8ED40000-memory.dmp

Download

memory/5872-1392-0x000002359E390000-0x000002359E442000-memory.dmp

Download