hxxps://download[.]tidal[.]com/desktop/TIDALSetup[.]exe

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15/01/2023, 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://download.tidal.com/desktop/TIDALSetup.exe

Score

10^/10

discovery persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\LICENSES.chromium.html

Ransom Note

<!doctype html> <html> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <meta name="color-scheme" content="light dark"> <title>Credits</title> <link rel="stylesheet" href="chrome://resources/css/text_defaults.css"> <link rel="stylesheet" href="chrome://credits/credits.css"> </head> <body> <span class="page-title" style="float:left;">Credits</span> <a id="print-link" href="#" style="float:right;" hidden>Print</a> <div style="clear:both; overflow:auto;"> <div class="product"> <span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span> <span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span> <input type="checkbox" hidden id="0"> <label class="show" for="0" tabindex="0"></label> <div class="licence"> <pre>Copyright(C) 1997,2001 Takuya OOURA (email: [email protected]). You may use, copy, modify this code for any purpose and without fee. You may distribute this ORIGINAL package. </pre> </div> </div> <div class="product"> <span class="title">Abseil</span> <span class="homepage"><a href="https://github.com/abseil/abseil-cpp">homepage</a></span> <input type="checkbox" hidden id="1"> <label class="show" for="1" tabindex="0"></label> <div class="licence"> <pre> Apache License Version 2.0, January 2004 https://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright [yyyy] [name of copyright owner] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. </pre> </div> </div> <div class="product"> <span class="title">Accessibility Audit library, from Accessibility Developer Tools</span> <span class="homepage"><a href="https://raw.githubusercontent.com/GoogleChrome/accessibility-developer-tools/master/dist/js/axs_testing.js">homepage</a></span> <input type="checkbox" hidden id="2"> <label class="show" for="2" tabindex="0"></label> <div class="licence"> <pre> Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to t

Emails

[email protected]

[email protected])&quot

[email protected]

<[email protected]&gt

[email protected]

<[email protected]&gt

URLs

https://www.apache.org/licenses/

https://www.apache.org/licenses/LICENSE-2.0

http://www.apache.org/licenses/

http://www.apache.org/licenses/LICENSE-2.0

http://www.apache.org/quot

http://mozilla.org/MPL/2.0/

http://www.torchmobile.com/

https://cla.developers.google.com/clas

http://www.openssl.org/)&quot

https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS

http://www.opensource.apple.com/apsl/

https://github.com/typetools/jdk

https://github.com/typetools/stubparser

https://github.com/typetools/annotation-tools

https://github.com/plume-lib/

http://www.mozilla.org/MPL/

http://source.android.com/

http://source.android.com/compatibility

http://www.apple.com/legal/guidelinesfor3rdparties.html

https://creativecommons.org/

Signatures

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

pid	Process
980	TIDALSetup.exe
1644	Update.exe
868	TIDAL.exe
1820	TIDAL.exe
432	TIDAL.exe
1156	TIDAL.exe
1736	TIDALPlayer.exe
1708	TIDAL.exe
928	TIDAL.exe
1704	Update.exe
1828	TIDAL.exe
1692	TIDAL.exe
1712	TIDAL.exe
1388	TIDAL.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation	TIDAL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation	TIDAL.exe

Loads dropped DLL 52 IoCs

pid	Process
980	TIDALSetup.exe
1644	Update.exe
1644	Update.exe
1644	Update.exe
1644	Update.exe
1644	Update.exe
868	TIDAL.exe
1820	TIDAL.exe
868	TIDAL.exe
432	TIDAL.exe
1156	TIDAL.exe
432	TIDAL.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
1736	TIDALPlayer.exe
928	TIDAL.exe
432	TIDAL.exe
1708	TIDAL.exe
1708	TIDAL.exe
1708	TIDAL.exe
1708	TIDAL.exe
1828	TIDAL.exe
1828	TIDAL.exe
1828	TIDAL.exe
1828	TIDAL.exe
1828	TIDAL.exe
1828	TIDAL.exe
1828	TIDAL.exe
1828	TIDAL.exe
1828	TIDAL.exe
1692	TIDAL.exe
1712	TIDAL.exe
1388	TIDAL.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\TIDAL = "C:\\Users\\Admin\\AppData\\Local\\TIDAL\\update.exe --processStart TIDAL.exe --process-start-args \"-autostart\""	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	TIDAL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	TIDAL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	TIDAL.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TIDAL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TIDAL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TIDAL.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 50f06d45db28d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003d000000900300001d020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DCAF421-94CE-11ED-BF99-4ED4A804E0FC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tidal\shell\open	TIDAL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tidal\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\TIDAL\\app-2.34.2\\TIDAL.exe\" \"%1\""	TIDAL.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tidal	TIDAL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tidal\URL Protocol	TIDAL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tidal\ = "URL:tidal"	TIDAL.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tidal\shell\open\command	TIDAL.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tidal\shell	TIDAL.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1504	reg.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	TIDAL.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	TIDAL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	TIDAL.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	TIDAL.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	TIDAL.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	TIDAL.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1644	Update.exe
1644	Update.exe
1736	TIDALPlayer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	Update.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: 33	1860	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1860	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	1876	WMIC.exe
Token: SeSecurityPrivilege	1876	WMIC.exe
Token: SeTakeOwnershipPrivilege	1876	WMIC.exe
Token: SeLoadDriverPrivilege	1876	WMIC.exe
Token: SeSystemProfilePrivilege	1876	WMIC.exe
Token: SeSystemtimePrivilege	1876	WMIC.exe
Token: SeProfSingleProcessPrivilege	1876	WMIC.exe
Token: SeIncBasePriorityPrivilege	1876	WMIC.exe
Token: SeCreatePagefilePrivilege	1876	WMIC.exe
Token: SeBackupPrivilege	1876	WMIC.exe
Token: SeRestorePrivilege	1876	WMIC.exe
Token: SeShutdownPrivilege	1876	WMIC.exe
Token: SeDebugPrivilege	1876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1876	WMIC.exe
Token: SeRemoteShutdownPrivilege	1876	WMIC.exe
Token: SeUndockPrivilege	1876	WMIC.exe
Token: SeManageVolumePrivilege	1876	WMIC.exe
Token: 33	1876	WMIC.exe
Token: 34	1876	WMIC.exe
Token: 35	1876	WMIC.exe
Token: 33	1860	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1860	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	1876	WMIC.exe
Token: SeSecurityPrivilege	1876	WMIC.exe
Token: SeTakeOwnershipPrivilege	1876	WMIC.exe
Token: SeLoadDriverPrivilege	1876	WMIC.exe
Token: SeSystemProfilePrivilege	1876	WMIC.exe
Token: SeSystemtimePrivilege	1876	WMIC.exe
Token: SeProfSingleProcessPrivilege	1876	WMIC.exe
Token: SeIncBasePriorityPrivilege	1876	WMIC.exe
Token: SeCreatePagefilePrivilege	1876	WMIC.exe
Token: SeBackupPrivilege	1876	WMIC.exe
Token: SeRestorePrivilege	1876	WMIC.exe
Token: SeShutdownPrivilege	1876	WMIC.exe
Token: SeDebugPrivilege	1876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1876	WMIC.exe
Token: SeRemoteShutdownPrivilege	1876	WMIC.exe
Token: SeUndockPrivilege	1876	WMIC.exe
Token: SeManageVolumePrivilege	1876	WMIC.exe
Token: 33	1876	WMIC.exe
Token: 34	1876	WMIC.exe
Token: 35	1876	WMIC.exe
Token: SeDebugPrivilege	1704	Update.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe
Token: SeShutdownPrivilege	432	TIDAL.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
1644	Update.exe
432	TIDAL.exe
432	TIDAL.exe
432	TIDAL.exe
432	TIDAL.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
432	TIDAL.exe
432	TIDAL.exe
432	TIDAL.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
308	IEXPLORE.EXE
308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 308	1924	iexplore.exe	29
PID 1924 wrote to memory of 308	1924	iexplore.exe	29
PID 1924 wrote to memory of 308	1924	iexplore.exe	29
PID 1924 wrote to memory of 308	1924	iexplore.exe	29
PID 1924 wrote to memory of 980	1924	iexplore.exe	31
PID 1924 wrote to memory of 980	1924	iexplore.exe	31
PID 1924 wrote to memory of 980	1924	iexplore.exe	31
PID 1924 wrote to memory of 980	1924	iexplore.exe	31
PID 1924 wrote to memory of 980	1924	iexplore.exe	31
PID 1924 wrote to memory of 980	1924	iexplore.exe	31
PID 1924 wrote to memory of 980	1924	iexplore.exe	31
PID 980 wrote to memory of 1644	980	TIDALSetup.exe	32
PID 980 wrote to memory of 1644	980	TIDALSetup.exe	32
PID 980 wrote to memory of 1644	980	TIDALSetup.exe	32
PID 980 wrote to memory of 1644	980	TIDALSetup.exe	32
PID 980 wrote to memory of 1644	980	TIDALSetup.exe	32
PID 980 wrote to memory of 1644	980	TIDALSetup.exe	32
PID 980 wrote to memory of 1644	980	TIDALSetup.exe	32
PID 1644 wrote to memory of 868	1644	Update.exe	33
PID 1644 wrote to memory of 868	1644	Update.exe	33
PID 1644 wrote to memory of 868	1644	Update.exe	33
PID 1644 wrote to memory of 868	1644	Update.exe	33
PID 868 wrote to memory of 1820	868	TIDAL.exe	34
PID 868 wrote to memory of 1820	868	TIDAL.exe	34
PID 868 wrote to memory of 1820	868	TIDAL.exe	34
PID 868 wrote to memory of 1820	868	TIDAL.exe	34
PID 1644 wrote to memory of 432	1644	Update.exe	36
PID 1644 wrote to memory of 432	1644	Update.exe	36
PID 1644 wrote to memory of 432	1644	Update.exe	36
PID 1644 wrote to memory of 432	1644	Update.exe	36
PID 432 wrote to memory of 1156	432	TIDAL.exe	37
PID 432 wrote to memory of 1156	432	TIDAL.exe	37
PID 432 wrote to memory of 1156	432	TIDAL.exe	37
PID 432 wrote to memory of 1156	432	TIDAL.exe	37
PID 432 wrote to memory of 1736	432	TIDAL.exe	38
PID 432 wrote to memory of 1736	432	TIDAL.exe	38
PID 432 wrote to memory of 1736	432	TIDAL.exe	38
PID 432 wrote to memory of 1736	432	TIDAL.exe	38
PID 432 wrote to memory of 624	432	TIDAL.exe	40
PID 432 wrote to memory of 624	432	TIDAL.exe	40
PID 432 wrote to memory of 624	432	TIDAL.exe	40
PID 432 wrote to memory of 624	432	TIDAL.exe	40
PID 432 wrote to memory of 1504	432	TIDAL.exe	41
PID 432 wrote to memory of 1504	432	TIDAL.exe	41
PID 432 wrote to memory of 1504	432	TIDAL.exe	41
PID 432 wrote to memory of 1504	432	TIDAL.exe	41
PID 624 wrote to memory of 1876	624	cmd.exe	45
PID 624 wrote to memory of 1876	624	cmd.exe	45
PID 624 wrote to memory of 1876	624	cmd.exe	45
PID 624 wrote to memory of 1876	624	cmd.exe	45
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46
PID 432 wrote to memory of 1708	432	TIDAL.exe	46

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://download.tidal.com/desktop/TIDALSetup.exe
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:308
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PULJ7CSW\TIDALSetup.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PULJ7CSW\TIDALSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe
      "C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe" --squirrel-install 2.34.2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:868
    - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe
        
        C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\TIDAL /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\TIDAL\Crashpad --url=https://f.a.k/e --annotation=_productName=TIDAL --annotation=_version=2.34.2 --annotation=plat=Win32 --annotation=prod=Electron --annotation=ver=21.2.3 --initial-client-data=0x318,0x31c,0x320,0x314,0x324,0x7fc9f18,0x7fc9f28,0x7fc9f34
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\TIDAL\update.exe
        
        C:\Users\Admin\AppData\Local\TIDAL\update.exe --createShortcut TIDAL.exe
        5⤵
        
        PID:1496
  - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe
      "C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe" --squirrel-firstrun
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      Checks processor information in registry
      Modifies registry class
      Modifies system certificate store
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe
        
        C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\TIDAL /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\TIDAL\Crashpad --url=https://f.a.k/e --annotation=_productName=TIDAL --annotation=_version=2.34.2 --annotation=plat=Win32 --annotation=prod=Electron --annotation=ver=21.2.3 --initial-client-data=0x2fc,0x300,0x304,0x2f8,0x308,0x7fc9f18,0x7fc9f28,0x7fc9f34
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1156
    - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\TIDALPlayer.exe
        
        C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\TIDALPlayer.exe -log=C:\Users\Admin\AppData\Roaming\TIDAL\Logs\player.log -crash-dump-path=C:\Users\Admin\AppData\Roaming\TIDAL\CrashDumps
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1736
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:624
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic CsProduct Get UUID
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v TIDAL /t REG_SZ /d "C:\Users\Admin\AppData\Local\TIDAL\update.exe --processStart TIDAL.exe --process-start-args \"-autostart\"" /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe
        
        "C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TIDAL" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1088 --field-trial-handle=1184,i,1954640424751437449,2205123273546200154,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\TIDAL\Update.exe
        
        C:\Users\Admin\AppData\Local\TIDAL\Update.exe --checkForUpdate https://download.tidal.com/desktop/windows/
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe
        
        "C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TIDAL" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1376 --field-trial-handle=1184,i,1954640424751437449,2205123273546200154,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:928
    - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe
        
        "C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TIDAL" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1152 --field-trial-handle=1184,i,1954640424751437449,2205123273546200154,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe
        
        "C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Roaming\TIDAL" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2116 --field-trial-handle=1184,i,1954640424751437449,2205123273546200154,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1692
    - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe
        
        "C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TIDAL" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-user-model-id=com.squirrel.TIDAL.TIDAL --app-path="C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1184,i,1954640424751437449,2205123273546200154,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:1712
    - - C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe
        
        "C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\TIDAL" --standard-schemes --secure-schemes --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2440 --field-trial-handle=1184,i,1954640424751437449,2205123273546200154,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1388

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x47c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d25af97ad275b3694fd2bdd54a55f225

SHA1
ea6000b49d67eb09cc4ac91d234c4b8f4a237f48

SHA256
7511fe320f5c431a081989e14bbb92f2508ad66c38532e8273a0c28c57f06638

SHA512
7800ec9484503acbf7e5a5eab010659027981bae2815b353da06304284e230093872ad585302aa363d10d1dea0784c2aa99dbe243bfd50fd148def7d4fb2676b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PULJ7CSW\TIDALSetup.exe

Filesize
117.1MB

MD5
c9a9f12421d7b804f531fce8a0275e3d

SHA1
010c4d7a3b10f4e72f0f06e8b90028302c9fe1e0

SHA256
c0d9e24555acaac2b697d382e2adaf6ac2b133e9a8ea5783dab2bb944e470c53

SHA512
98f0243c7cb672b30ce359b57896483193f0212b193d53dbdb71f25d262d05ba5311c246462d4296dd29313c7fce5648045884b8fb687638303bf22925818b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PULJ7CSW\TIDALSetup.exe.344kwcf.partial

Filesize
117.1MB

MD5
c9a9f12421d7b804f531fce8a0275e3d

SHA1
010c4d7a3b10f4e72f0f06e8b90028302c9fe1e0

SHA256
c0d9e24555acaac2b697d382e2adaf6ac2b133e9a8ea5783dab2bb944e470c53

SHA512
98f0243c7cb672b30ce359b57896483193f0212b193d53dbdb71f25d262d05ba5311c246462d4296dd29313c7fce5648045884b8fb687638303bf22925818b66

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

Filesize
74B

MD5
b480a1d65b29b4cb8e4b7072081e22e6

SHA1
80c8b31eeff62df8dc1f10c3b583cd650df274d2

SHA256
61ff99219c48ceab3c9779b7cee50f8880248226f18b6d6b42471ddde4aa8e95

SHA512
1938edcb78345c43d9c17f0b36da4f43754e3d57087d94a66fc499828d2cce1b5d930e67c85fafe47044dbc4dc3f209bc45c288ca5cfc7038e8875481abdd964

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\TIDAL-2.34.2-full.nupkg

Filesize
116.3MB

MD5
5a774f86997dd987f5325a934e8ac8f7

SHA1
0abb67d5869a4a804e4c500594f3f57d4d8dc694

SHA256
148416584d3bfc7afb9804863eedd8ae7c4c0902cf241126f6ebd44af475bb8d

SHA512
971a8865a080f8f09643dd1235eac174aa5a0dcfe079c5f74016b14cdc8052b96490777411f15a709e9273c6781226edd6b347e74e80d279dd3023b7e7eb6f46

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.8MB

MD5
dbf7df124ed6a4100172c398b0ca87c1

SHA1
bb8cf44c26c69588608a8973a46ebaa562262009

SHA256
21bdb461df4eb29e5f401794ab7d47fe4ca9fdbeaad94513d733012d9c79a74d

SHA512
6f9744f9107782d5df930cf4dffc6f4f05152bd4c178497e3444533e3480c2930921ea878eacbc44735679b21b0d42a0a3260469ec7e7b3412989523da6e5569

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.8MB

MD5
dbf7df124ed6a4100172c398b0ca87c1

SHA1
bb8cf44c26c69588608a8973a46ebaa562262009

SHA256
21bdb461df4eb29e5f401794ab7d47fe4ca9fdbeaad94513d733012d9c79a74d

SHA512
6f9744f9107782d5df930cf4dffc6f4f05152bd4c178497e3444533e3480c2930921ea878eacbc44735679b21b0d42a0a3260469ec7e7b3412989523da6e5569

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

Filesize
8KB

MD5
6ce9ad0123e3496523a7f8943ba64a65

SHA1
a1d4ee4b539daa18195c1e64682b40bb80c30bd0

SHA256
e07a1d79c0af716596b44db37eb81eac289fcf2b01eabe246b901dd90451cb30

SHA512
077e168db026d80e501bac401d53117d359bc135d5d05951d14755fb72cd81d11de93988cee66f0793048dab46259bda5bba809fc47c877fa0e1d322f8db483f

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe

Filesize
128.1MB

MD5
7c07a7a74306efd3fb1e1cd5a41b55ad

SHA1
31dff36f6a40d724d2af2fe1d3fb74d03ffe4ff3

SHA256
92a61b2a511ad6490211a1dbe84bf6b0f8a1de1ef2e95b0c4d20f8625422f8e1

SHA512
42f6491ac219b332695888ce0c8a407dd4db2b9123051e71892a51f20f2b407f4e5e72a9b2f91673e4f0ecfab375c88681c8d3594439d5aa2ee1e15768fd4dca

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe

Filesize
128.1MB

MD5
7c07a7a74306efd3fb1e1cd5a41b55ad

SHA1
31dff36f6a40d724d2af2fe1d3fb74d03ffe4ff3

SHA256
92a61b2a511ad6490211a1dbe84bf6b0f8a1de1ef2e95b0c4d20f8625422f8e1

SHA512
42f6491ac219b332695888ce0c8a407dd4db2b9123051e71892a51f20f2b407f4e5e72a9b2f91673e4f0ecfab375c88681c8d3594439d5aa2ee1e15768fd4dca

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe

Filesize
128.1MB

MD5
7c07a7a74306efd3fb1e1cd5a41b55ad

SHA1
31dff36f6a40d724d2af2fe1d3fb74d03ffe4ff3

SHA256
92a61b2a511ad6490211a1dbe84bf6b0f8a1de1ef2e95b0c4d20f8625422f8e1

SHA512
42f6491ac219b332695888ce0c8a407dd4db2b9123051e71892a51f20f2b407f4e5e72a9b2f91673e4f0ecfab375c88681c8d3594439d5aa2ee1e15768fd4dca

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe

Filesize
128.1MB

MD5
7c07a7a74306efd3fb1e1cd5a41b55ad

SHA1
31dff36f6a40d724d2af2fe1d3fb74d03ffe4ff3

SHA256
92a61b2a511ad6490211a1dbe84bf6b0f8a1de1ef2e95b0c4d20f8625422f8e1

SHA512
42f6491ac219b332695888ce0c8a407dd4db2b9123051e71892a51f20f2b407f4e5e72a9b2f91673e4f0ecfab375c88681c8d3594439d5aa2ee1e15768fd4dca

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\ffmpeg.dll

Filesize
2.4MB

MD5
8c66d39b964386c790712504aaebc717

SHA1
c4b59816bece4cc3c375f897ddc80ab9134820a6

SHA256
f76c8b236b714455749d36fedc92d86d78e1059226b854a0822a505f6037b1c5

SHA512
be9cc59d85b80b24d36578ccaa02fa8f70da968804647b287a648854d24cc01cbefe03d0b499144941ff725463f1dbcdea5fbe4661c25c4a60ec4f441ef01c38

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\icudtl.dat

Filesize
10.0MB

MD5
cf9421b601645bda331c7136a0a9c3f8

SHA1
9950d66df9022f1caa941ab0e9647636f7b7a286

SHA256
8d8a74ca376338623170d59c455476218d5a667d5991a52556aa9c9a70ebc5e5

SHA512
bc9601e2b4ab28130bfadfd6f61b3ed500deb0bd235dc5ca94999c09f59d10bdcbf278869a9802f918830041f620c88e2c3b506608ade661db48ccd84c1977eb

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar

Filesize
56.5MB

MD5
737992dc6ba87815248b9c2b412fc151

SHA1
8ca28175238aa77f1aa3ca04116a047999fbea6c

SHA256
6a82a99c5e10a1aff587dba1d6f121662b149120644e38c57d38f1cb391088fc

SHA512
41c5d652217bd4583cb40f8f8a02b7b5172951105ce0951d9297aa08b7eb980558c064d865288a4a4ecf538c6cf8c973d6bad5927b55e5f621aefb95df6b398a

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\LibUSB.dll

Filesize
33KB

MD5
e4d9baab0295ff2e69323a274a9eb566

SHA1
eb8efd0cb7b38adbd97bdc7ada3b8cc6bcb87265

SHA256
63a0a0492ff5c75a0f6bed8468281932e288fabdab677b2df0e1a642fd914c1b

SHA512
f2e6556b23e52eb6dd13ae8d9e0e9af2bd84cb72ebd0c7f17cc22e7f30abab8ee2f2a7abaa10b44ed82b52f04470f819ab822f251e4b64684bcdfc1e463d6022

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\MSVCP140.dll

Filesize
432KB

MD5
494fa531a0c4539615c9f6ee4c5c0849

SHA1
480a699c2df69dc759225e81ff3a81788654b738

SHA256
a7960e849ebd769a4ebf453f1b7dc7190289bae7f3d107231d09d9608622a5a5

SHA512
23456ab7bff7ab599b724c60666c81b420ae37471910f524164864bc8699a5241ab72d808729cd0ccd5f9fad4e9a8802f47a6d12470e78eaba6aa12e255073fc

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\TIDALPlayer.exe

Filesize
1.3MB

MD5
7f28a1cff8df0cb7b8cd4533dfd0816e

SHA1
b69112d7841a49d0829363ac81b5340c41a29e63

SHA256
cc614cca10783b9c6a38aa6da71a02b8b77730ac2a320482bc112abc12d31f40

SHA512
47684e6bcba0a0fe37a5bba7f2129b8f7db0d9797a0032714597b4187111960e113fe12a0dd2d7ef191b86ec2568d679e884f3f603d6107caf7de65daa042b46

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\TIDALPlayer.exe

Filesize
1.3MB

MD5
7f28a1cff8df0cb7b8cd4533dfd0816e

SHA1
b69112d7841a49d0829363ac81b5340c41a29e63

SHA256
cc614cca10783b9c6a38aa6da71a02b8b77730ac2a320482bc112abc12d31f40

SHA512
47684e6bcba0a0fe37a5bba7f2129b8f7db0d9797a0032714597b4187111960e113fe12a0dd2d7ef191b86ec2568d679e884f3f603d6107caf7de65daa042b46

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\VCRUNTIME140.dll

Filesize
86KB

MD5
aedac7d0dd55ee92c443b4fc17972ce9

SHA1
a9e07790dad09809706fe9df00f5be6ff1658bcd

SHA256
7272e3be4ac2db41830678c759c109f8ff87ec99883ed89d1bc000e4077cc313

SHA512
f94954e853f6c4adec6c624806339dff289cb04dc7ef2797a5891111b73321e6faf25af8a1673573c04e06bee40f2a8f445f6ed5386bfc07ef0aacc78281de49

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
92435c5a59f0b8dab3a3c8fce13df20a

SHA1
f8eb084036aa0d373dc600804c44031f448197aa

SHA256
c0e2043663e65c82b88a7b5079cba0c419605c08709ec0af60ea4aaf0c3932a9

SHA512
d5e890aaecb76fc93237a8af13a9c1d9f69de6998f2350b075d408e438fa4087617c840de7208699441a7740b3a535bfc89f7f731af59588e44b2951cb50f958

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-file-l2-1-0.dll

Filesize
21KB

MD5
f9cb0cdb0cf1118ad9922e115c48346e

SHA1
eab2eaf15247b54e375ea2477ff46d03fca1e29c

SHA256
3e8df43577ae8ba6ef985d62f508ef27821cc41921c2aaa1c51d06bb80faca70

SHA512
36073cd6a16d60857210a671ccf35ba88dd80405cd0b7a0f43aba734b92ecbdfd499ab93c72a7fa46be749c45182dfb11e87844740b71a60536432574cc498a9

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-localization-l1-2-0.dll

Filesize
24KB

MD5
686a5e333ec1cc3892213789de921a94

SHA1
ca503050a69bf2eb6cacc8704bd952df54627101

SHA256
fa4fb4bb0bcb9531028f79935be4dfa16aa4152cac550d76d2bd47d61459f470

SHA512
54164869108d400eae802fbdb096b2983e3a52c92d548e49e368fa0b7c210eb9ff64167f0e5ab51546be4d50eae050f94c5149814f6b40d221956c61bacde2a6

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
22KB

MD5
ae0f49fc63752a32a2f9916f6f6beffa

SHA1
99a9acc771badccf71760c4b597efd0d823596da

SHA256
e6c513c4024c91a8c0d04f4a549e8206a1e77c05e0705f185badfc44e4be80aa

SHA512
fd236ef81a792d87538709c3d843a2230e05d07031f4cf59b6fa278475547cc7ea47fa7fb5440c4a648eab84cf936e69179e9071606619ac1c1bb6b823c626d1

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-synch-l1-2-0.dll

Filesize
22KB

MD5
18f36c41fbc593ff0685cbedbc8e7905

SHA1
a50ecb04192abaa7ba96ce7eec457b71eb99b0e1

SHA256
b90d9368bb6b2f0500d3617da684562b0b16005382d1a5d076ff5604647e26a6

SHA512
27d908d6f9bf294f35370d298ea91b662ede57afe35b79628dcd8237247d90839067a60497ece6ec7fc6862fd3dff132824fad426e18a9dfd9dc5bf2b2b37ebf

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
167076fe41f72d148cc9dcf4654a7aa3

SHA1
4bacf45cf9fc622262c0006d7f39f178e3ae3927

SHA256
7c154f6a93493a09444dd06585139a3eb778b32728b56b699afdc339a48daf85

SHA512
2612bd83f755941fcdfe30e03e0cf50fb5929dc7948b720448d0b6c6a5b7011284f2c9eb2618212a3512c0758219ae19ca957b5c6341ad4a7260243c12fb46d2

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-crt-convert-l1-1-0.dll

Filesize
25KB

MD5
326e10a43d5353658d1a551d4c94976a

SHA1
f8c5e764721d32e6a73fb9afb773c89d5b2c2bc0

SHA256
0e89b08188f6e779ac6617e0f28abf7aaa21fea6721d9111400b4ab78c842c5c

SHA512
a222981c6c629484910501c2136537f6614a244a017e97cb19b15f245eac21af3cc4799c9c97de4c00933de2dcee165d6c16eca4fad04ac08a44ef70252fbaa4

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-crt-heap-l1-1-0.dll

Filesize
22KB

MD5
ae946115ff08b0b1f73d49f709b05925

SHA1
63b5559b0fac1b8609c2e79be0c73368c78f0ac0

SHA256
47852bc008b7d454dd437475dd59077f26f7c2e959f36721ee352eed9a2ac742

SHA512
6b062ec8183695379917c38059a38d16a9803377673da11f1353673bee5d00c7081746ba20bf622b32417f271b6b4bd49689668325ee1bba89b3219b07ed7760

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
26KB

MD5
7f5b8a3f8e501d3ff5c1ec820321118c

SHA1
58aa38b800fb4f3323ead1513396a7556916ca29

SHA256
e1af4c8ea1dba167a0edd8d8577657cee245d652199bd8f14baf3e6f3fd78222

SHA512
fdd3291d569c881e48b0add016a3bab734e98dbf651e5e98388965f317362ba859791526b0c097d9a82ef86915a9ac9033aecd12f44600f19121c601b990e033

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
27KB

MD5
5efb92231bbafed9caa21f7a6c776ea4

SHA1
97ca5010a39930056267fa26b8f060e5150ee62f

SHA256
df2721d78f0a7119d491a3609e004b9e0c51a9a1a80f30ccc457ead039475d24

SHA512
c5faa2b1d336e2f7548e10013e35764b403edb821b763538eb099cce0ba6c6ebd24dca4e97e4d35e9c491009011064881ecd702bf73da7febf201b0a80ebfa1a

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-crt-string-l1-1-0.dll

Filesize
27KB

MD5
b76a9f761216141b006b6393a6611d97

SHA1
409316d1cd5afd399040107c606c6a93919442a8

SHA256
c29b92ebceb267a132b57d73ee86776582ba24cc7c0d936d109fd973ff1a8708

SHA512
e98dffcb9f31b2108be74a6bb9ca4fbce244be5151c962421ecad16312cc50f243ef4f7cc26d9c76d5248f3dc7919463e79bc159e5959766423f54a46de3ef54

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\ucrtbase.DLL

Filesize
1.1MB

MD5
74ad05f1bbd83aedc7ea987e0b1a94f3

SHA1
c79545777f9729858aa0e07a2dff43aaaaf4bca5

SHA256
9823b42f7cd6f32a4d5de3f606b4243646067b1e54e379624ec774fb2f297469

SHA512
c2df8428ee63268d5989c88d4c42be7b52f132713fc6cbc5ca26137ee34e7c4ce29b19613c2636f0449c0ea44eabbe1669290e7b1660535982c6af178915cfea

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\app-2.34.2\v8_context_snapshot.bin

Filesize
590KB

MD5
dd9ca4878bba782613cba372de1c36f4

SHA1
2eefcb6fcaa4b2ed717c952895710be5701871a7

SHA256
ea33ca96024769386ae0ff100c2ae239507006d7340f1f8bbc5bcfb4195f9226

SHA512
0791d3827a6de5745d3424c562b16604cf311ed6fcb4cf62d2c7f54ec0b7f3535b1114e919d2ba6d144cbe9f45418a555ab3fd801078bd8d563a656796f5d4e6

Download Submit
C:\Users\Admin\AppData\Local\TIDAL\update.exe

Filesize
1.8MB

MD5
dbf7df124ed6a4100172c398b0ca87c1

SHA1
bb8cf44c26c69588608a8973a46ebaa562262009

SHA256
21bdb461df4eb29e5f401794ab7d47fe4ca9fdbeaad94513d733012d9c79a74d

SHA512
6f9744f9107782d5df930cf4dffc6f4f05152bd4c178497e3444533e3480c2930921ea878eacbc44735679b21b0d42a0a3260469ec7e7b3412989523da6e5569

Download Submit
C:\Users\Admin\AppData\Roaming\TIDAL\Crashpad\settings.dat

Filesize
40B

MD5
837683b82a8b63ecf8908d4ef3bbf7c4

SHA1
7f817d004514ba62727586e5303c2b19f167bbb9

SHA256
facf432267612933d83158575f2944492134d5e6c0bb0e3ba812fa25960e31de

SHA512
1cee9caf33989a0450e5e14fa2f36c851ba5e24c469c6b85dd1688de7b09d447c701c8380045e931796a14b0d8a72aea9b689ee1341d42c2b9bc160ecd14de24

Download Submit
\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.8MB

MD5
dbf7df124ed6a4100172c398b0ca87c1

SHA1
bb8cf44c26c69588608a8973a46ebaa562262009

SHA256
21bdb461df4eb29e5f401794ab7d47fe4ca9fdbeaad94513d733012d9c79a74d

SHA512
6f9744f9107782d5df930cf4dffc6f4f05152bd4c178497e3444533e3480c2930921ea878eacbc44735679b21b0d42a0a3260469ec7e7b3412989523da6e5569

Download Submit
\Users\Admin\AppData\Local\TIDAL\Update.exe

Filesize
1.8MB

MD5
dbf7df124ed6a4100172c398b0ca87c1

SHA1
bb8cf44c26c69588608a8973a46ebaa562262009

SHA256
21bdb461df4eb29e5f401794ab7d47fe4ca9fdbeaad94513d733012d9c79a74d

SHA512
6f9744f9107782d5df930cf4dffc6f4f05152bd4c178497e3444533e3480c2930921ea878eacbc44735679b21b0d42a0a3260469ec7e7b3412989523da6e5569

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe

Filesize
128.1MB

MD5
7c07a7a74306efd3fb1e1cd5a41b55ad

SHA1
31dff36f6a40d724d2af2fe1d3fb74d03ffe4ff3

SHA256
92a61b2a511ad6490211a1dbe84bf6b0f8a1de1ef2e95b0c4d20f8625422f8e1

SHA512
42f6491ac219b332695888ce0c8a407dd4db2b9123051e71892a51f20f2b407f4e5e72a9b2f91673e4f0ecfab375c88681c8d3594439d5aa2ee1e15768fd4dca

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe

Filesize
128.1MB

MD5
7c07a7a74306efd3fb1e1cd5a41b55ad

SHA1
31dff36f6a40d724d2af2fe1d3fb74d03ffe4ff3

SHA256
92a61b2a511ad6490211a1dbe84bf6b0f8a1de1ef2e95b0c4d20f8625422f8e1

SHA512
42f6491ac219b332695888ce0c8a407dd4db2b9123051e71892a51f20f2b407f4e5e72a9b2f91673e4f0ecfab375c88681c8d3594439d5aa2ee1e15768fd4dca

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\TIDAL.exe

Filesize
128.1MB

MD5
7c07a7a74306efd3fb1e1cd5a41b55ad

SHA1
31dff36f6a40d724d2af2fe1d3fb74d03ffe4ff3

SHA256
92a61b2a511ad6490211a1dbe84bf6b0f8a1de1ef2e95b0c4d20f8625422f8e1

SHA512
42f6491ac219b332695888ce0c8a407dd4db2b9123051e71892a51f20f2b407f4e5e72a9b2f91673e4f0ecfab375c88681c8d3594439d5aa2ee1e15768fd4dca

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\Update.exe

Filesize
1.8MB

MD5
dbf7df124ed6a4100172c398b0ca87c1

SHA1
bb8cf44c26c69588608a8973a46ebaa562262009

SHA256
21bdb461df4eb29e5f401794ab7d47fe4ca9fdbeaad94513d733012d9c79a74d

SHA512
6f9744f9107782d5df930cf4dffc6f4f05152bd4c178497e3444533e3480c2930921ea878eacbc44735679b21b0d42a0a3260469ec7e7b3412989523da6e5569

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\Update.exe

Filesize
1.8MB

MD5
dbf7df124ed6a4100172c398b0ca87c1

SHA1
bb8cf44c26c69588608a8973a46ebaa562262009

SHA256
21bdb461df4eb29e5f401794ab7d47fe4ca9fdbeaad94513d733012d9c79a74d

SHA512
6f9744f9107782d5df930cf4dffc6f4f05152bd4c178497e3444533e3480c2930921ea878eacbc44735679b21b0d42a0a3260469ec7e7b3412989523da6e5569

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\ffmpeg.dll

Filesize
2.4MB

MD5
8c66d39b964386c790712504aaebc717

SHA1
c4b59816bece4cc3c375f897ddc80ab9134820a6

SHA256
f76c8b236b714455749d36fedc92d86d78e1059226b854a0822a505f6037b1c5

SHA512
be9cc59d85b80b24d36578ccaa02fa8f70da968804647b287a648854d24cc01cbefe03d0b499144941ff725463f1dbcdea5fbe4661c25c4a60ec4f441ef01c38

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\ffmpeg.dll

Filesize
2.4MB

MD5
8c66d39b964386c790712504aaebc717

SHA1
c4b59816bece4cc3c375f897ddc80ab9134820a6

SHA256
f76c8b236b714455749d36fedc92d86d78e1059226b854a0822a505f6037b1c5

SHA512
be9cc59d85b80b24d36578ccaa02fa8f70da968804647b287a648854d24cc01cbefe03d0b499144941ff725463f1dbcdea5fbe4661c25c4a60ec4f441ef01c38

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\ffmpeg.dll

Filesize
2.4MB

MD5
8c66d39b964386c790712504aaebc717

SHA1
c4b59816bece4cc3c375f897ddc80ab9134820a6

SHA256
f76c8b236b714455749d36fedc92d86d78e1059226b854a0822a505f6037b1c5

SHA512
be9cc59d85b80b24d36578ccaa02fa8f70da968804647b287a648854d24cc01cbefe03d0b499144941ff725463f1dbcdea5fbe4661c25c4a60ec4f441ef01c38

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\ffmpeg.dll

Filesize
2.4MB

MD5
8c66d39b964386c790712504aaebc717

SHA1
c4b59816bece4cc3c375f897ddc80ab9134820a6

SHA256
f76c8b236b714455749d36fedc92d86d78e1059226b854a0822a505f6037b1c5

SHA512
be9cc59d85b80b24d36578ccaa02fa8f70da968804647b287a648854d24cc01cbefe03d0b499144941ff725463f1dbcdea5fbe4661c25c4a60ec4f441ef01c38

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\LibUSB.dll

Filesize
33KB

MD5
e4d9baab0295ff2e69323a274a9eb566

SHA1
eb8efd0cb7b38adbd97bdc7ada3b8cc6bcb87265

SHA256
63a0a0492ff5c75a0f6bed8468281932e288fabdab677b2df0e1a642fd914c1b

SHA512
f2e6556b23e52eb6dd13ae8d9e0e9af2bd84cb72ebd0c7f17cc22e7f30abab8ee2f2a7abaa10b44ed82b52f04470f819ab822f251e4b64684bcdfc1e463d6022

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\TIDALPlayer.exe

Filesize
1.3MB

MD5
7f28a1cff8df0cb7b8cd4533dfd0816e

SHA1
b69112d7841a49d0829363ac81b5340c41a29e63

SHA256
cc614cca10783b9c6a38aa6da71a02b8b77730ac2a320482bc112abc12d31f40

SHA512
47684e6bcba0a0fe37a5bba7f2129b8f7db0d9797a0032714597b4187111960e113fe12a0dd2d7ef191b86ec2568d679e884f3f603d6107caf7de65daa042b46

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
92435c5a59f0b8dab3a3c8fce13df20a

SHA1
f8eb084036aa0d373dc600804c44031f448197aa

SHA256
c0e2043663e65c82b88a7b5079cba0c419605c08709ec0af60ea4aaf0c3932a9

SHA512
d5e890aaecb76fc93237a8af13a9c1d9f69de6998f2350b075d408e438fa4087617c840de7208699441a7740b3a535bfc89f7f731af59588e44b2951cb50f958

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-file-l2-1-0.dll

Filesize
21KB

MD5
f9cb0cdb0cf1118ad9922e115c48346e

SHA1
eab2eaf15247b54e375ea2477ff46d03fca1e29c

SHA256
3e8df43577ae8ba6ef985d62f508ef27821cc41921c2aaa1c51d06bb80faca70

SHA512
36073cd6a16d60857210a671ccf35ba88dd80405cd0b7a0f43aba734b92ecbdfd499ab93c72a7fa46be749c45182dfb11e87844740b71a60536432574cc498a9

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-localization-l1-2-0.dll

Filesize
24KB

MD5
686a5e333ec1cc3892213789de921a94

SHA1
ca503050a69bf2eb6cacc8704bd952df54627101

SHA256
fa4fb4bb0bcb9531028f79935be4dfa16aa4152cac550d76d2bd47d61459f470

SHA512
54164869108d400eae802fbdb096b2983e3a52c92d548e49e368fa0b7c210eb9ff64167f0e5ab51546be4d50eae050f94c5149814f6b40d221956c61bacde2a6

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
22KB

MD5
ae0f49fc63752a32a2f9916f6f6beffa

SHA1
99a9acc771badccf71760c4b597efd0d823596da

SHA256
e6c513c4024c91a8c0d04f4a549e8206a1e77c05e0705f185badfc44e4be80aa

SHA512
fd236ef81a792d87538709c3d843a2230e05d07031f4cf59b6fa278475547cc7ea47fa7fb5440c4a648eab84cf936e69179e9071606619ac1c1bb6b823c626d1

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-synch-l1-2-0.dll

Filesize
22KB

MD5
18f36c41fbc593ff0685cbedbc8e7905

SHA1
a50ecb04192abaa7ba96ce7eec457b71eb99b0e1

SHA256
b90d9368bb6b2f0500d3617da684562b0b16005382d1a5d076ff5604647e26a6

SHA512
27d908d6f9bf294f35370d298ea91b662ede57afe35b79628dcd8237247d90839067a60497ece6ec7fc6862fd3dff132824fad426e18a9dfd9dc5bf2b2b37ebf

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
167076fe41f72d148cc9dcf4654a7aa3

SHA1
4bacf45cf9fc622262c0006d7f39f178e3ae3927

SHA256
7c154f6a93493a09444dd06585139a3eb778b32728b56b699afdc339a48daf85

SHA512
2612bd83f755941fcdfe30e03e0cf50fb5929dc7948b720448d0b6c6a5b7011284f2c9eb2618212a3512c0758219ae19ca957b5c6341ad4a7260243c12fb46d2

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-crt-convert-l1-1-0.dll

Filesize
25KB

MD5
326e10a43d5353658d1a551d4c94976a

SHA1
f8c5e764721d32e6a73fb9afb773c89d5b2c2bc0

SHA256
0e89b08188f6e779ac6617e0f28abf7aaa21fea6721d9111400b4ab78c842c5c

SHA512
a222981c6c629484910501c2136537f6614a244a017e97cb19b15f245eac21af3cc4799c9c97de4c00933de2dcee165d6c16eca4fad04ac08a44ef70252fbaa4

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-crt-heap-l1-1-0.dll

Filesize
22KB

MD5
ae946115ff08b0b1f73d49f709b05925

SHA1
63b5559b0fac1b8609c2e79be0c73368c78f0ac0

SHA256
47852bc008b7d454dd437475dd59077f26f7c2e959f36721ee352eed9a2ac742

SHA512
6b062ec8183695379917c38059a38d16a9803377673da11f1353673bee5d00c7081746ba20bf622b32417f271b6b4bd49689668325ee1bba89b3219b07ed7760

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
26KB

MD5
7f5b8a3f8e501d3ff5c1ec820321118c

SHA1
58aa38b800fb4f3323ead1513396a7556916ca29

SHA256
e1af4c8ea1dba167a0edd8d8577657cee245d652199bd8f14baf3e6f3fd78222

SHA512
fdd3291d569c881e48b0add016a3bab734e98dbf651e5e98388965f317362ba859791526b0c097d9a82ef86915a9ac9033aecd12f44600f19121c601b990e033

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
27KB

MD5
5efb92231bbafed9caa21f7a6c776ea4

SHA1
97ca5010a39930056267fa26b8f060e5150ee62f

SHA256
df2721d78f0a7119d491a3609e004b9e0c51a9a1a80f30ccc457ead039475d24

SHA512
c5faa2b1d336e2f7548e10013e35764b403edb821b763538eb099cce0ba6c6ebd24dca4e97e4d35e9c491009011064881ecd702bf73da7febf201b0a80ebfa1a

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\api-ms-win-crt-string-l1-1-0.dll

Filesize
27KB

MD5
b76a9f761216141b006b6393a6611d97

SHA1
409316d1cd5afd399040107c606c6a93919442a8

SHA256
c29b92ebceb267a132b57d73ee86776582ba24cc7c0d936d109fd973ff1a8708

SHA512
e98dffcb9f31b2108be74a6bb9ca4fbce244be5151c962421ecad16312cc50f243ef4f7cc26d9c76d5248f3dc7919463e79bc159e5959766423f54a46de3ef54

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\msvcp140.dll

Filesize
432KB

MD5
494fa531a0c4539615c9f6ee4c5c0849

SHA1
480a699c2df69dc759225e81ff3a81788654b738

SHA256
a7960e849ebd769a4ebf453f1b7dc7190289bae7f3d107231d09d9608622a5a5

SHA512
23456ab7bff7ab599b724c60666c81b420ae37471910f524164864bc8699a5241ab72d808729cd0ccd5f9fad4e9a8802f47a6d12470e78eaba6aa12e255073fc

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\ucrtbase.dll

Filesize
1.1MB

MD5
74ad05f1bbd83aedc7ea987e0b1a94f3

SHA1
c79545777f9729858aa0e07a2dff43aaaaf4bca5

SHA256
9823b42f7cd6f32a4d5de3f606b4243646067b1e54e379624ec774fb2f297469

SHA512
c2df8428ee63268d5989c88d4c42be7b52f132713fc6cbc5ca26137ee34e7c4ce29b19613c2636f0449c0ea44eabbe1669290e7b1660535982c6af178915cfea

Download Submit
\Users\Admin\AppData\Local\TIDAL\app-2.34.2\resources\app.asar.unpacked\resources\win\vcruntime140.dll

Filesize
86KB

MD5
aedac7d0dd55ee92c443b4fc17972ce9

SHA1
a9e07790dad09809706fe9df00f5be6ff1658bcd

SHA256
7272e3be4ac2db41830678c759c109f8ff87ec99883ed89d1bc000e4077cc313

SHA512
f94954e853f6c4adec6c624806339dff289cb04dc7ef2797a5891111b73321e6faf25af8a1673573c04e06bee40f2a8f445f6ed5386bfc07ef0aacc78281de49

Download Submit
memory/980-59-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1644-97-0x0000000000D30000-0x0000000000D3A000-memory.dmp

Filesize
40KB

Download
memory/1644-95-0x0000000000D30000-0x0000000000D3A000-memory.dmp

Filesize
40KB

Download
memory/1644-64-0x0000000000190000-0x0000000000354000-memory.dmp

Filesize
1.8MB

Download
memory/1644-69-0x0000000000D30000-0x0000000000D3A000-memory.dmp

Filesize
40KB

Download
memory/1644-70-0x0000000000D30000-0x0000000000D3A000-memory.dmp

Filesize
40KB

Download
memory/1644-76-0x0000000006430000-0x0000000006467000-memory.dmp

Filesize
220KB

Download
memory/1704-184-0x0000000001160000-0x0000000001324000-memory.dmp

Filesize
1.8MB

Download