Analysis

  • max time kernel
    88s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    16-03-2023 14:10

General

  • Target

    SpotXBasic.bat

  • Size

    428B

  • MD5

    86051a369086cf1fea76a3afc5372b7b

  • SHA1

    3b787fad5b363a3193b295ce422b496892463f02

  • SHA256

    433b9c9d8ca325e6a58098480d9ea9193ef87ebd7275a6f4e81271f4e2220566

  • SHA512

    8e71253ea3e27560e84613f1b4313b031711601fc5c1caedc6e8519146bdf93640351af3c24266699abba3a1e7dea6932e088557b8734705def73eda87e03b3f

Score
10/10

Malware Config

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpotXBasic.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3172
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "&{[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12}; """"& { $((Invoke-WebRequest -UseBasicParsing 'https://raw.githubusercontent.com/amd64fox/SpotX/main/Install.ps1').Content)} -confirm_uninstall_ms_spoti -confirm_spoti_recomended_over -podcasts_on -cache_off -block_update_off -exp_standart -hide_col_icon_off -start_spoti"""" | Invoke-Expression"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" -V
        3⤵
          PID:644
        • C:\Windows\system32\curl.exe
          "C:\Windows\system32\curl.exe" -s -w %{http_code} -o /dev/null https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.7.1277.g2b3ce637-219.exe --retry 2 --ssl-no-revoke
          3⤵
            PID:628
          • C:\Windows\system32\curl.exe
            "C:\Windows\system32\curl.exe" https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.7.1277.g2b3ce637-219.exe -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-03-16_15-10-31\SpotifySetup.exe --progress-bar --retry 3 --ssl-no-revoke
            3⤵
              PID:792
            • C:\Windows\explorer.exe
              "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-03-16_15-10-31\SpotifySetup.exe
              3⤵
                PID:4452
              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4744
                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.7.1277 --initial-client-data=0x470,0x474,0x478,0x448,0x47c,0x69c33a38,0x69c33a48,0x69c33a54
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:5064
                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1912,i,5569395316586700113,15260037506065693932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
                  4⤵
                  • Executes dropped EXE
                  PID:3752
                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3080 --field-trial-handle=1912,i,5569395316586700113,15260037506065693932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                  4⤵
                    PID:748
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3096 --field-trial-handle=1912,i,5569395316586700113,15260037506065693932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                    4⤵
                      PID:5112
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --first-renderer-process --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3932 --field-trial-handle=1912,i,5569395316586700113,15260037506065693932,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
                      4⤵
                        PID:4756
                • C:\Windows\system32\taskmgr.exe
                  "C:\Windows\system32\taskmgr.exe" /4
                  1⤵
                  • Checks SCSI registry key(s)
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:4976
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3584
                  • C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-03-16_15-10-31\SpotifySetup.exe
                    "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-03-16_15-10-31\SpotifySetup.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1500
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      Spotify.exe
                      3⤵
                      • Executes dropped EXE
                      PID:4372
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                  1⤵
                    PID:4028
                  • C:\Windows\system32\werfault.exe
                    werfault.exe /hc /shared Global\e29765f6b6c8484b96c981c54d07f7b8 /t 3960 /p 3812
                    1⤵
                      PID:1480
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:1076

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Discovery

                      Query Registry

                      3
                      T1012

                      System Information Discovery

                      3
                      T1082

                      Peripheral Device Discovery

                      1
                      T1120

                      Command and Control

                      Web Service

                      1
                      T1102

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Spotify\Browser\Session Storage\MANIFEST-000001
                        Filesize

                        41B

                        MD5

                        5af87dfd673ba2115e2fcf5cfdb727ab

                        SHA1

                        d5b5bbf396dc291274584ef71f444f420b6056f1

                        SHA256

                        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                        SHA512

                        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                      • C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json
                        Filesize

                        687B

                        MD5

                        61980c8cc80bf6354ed9417bba19d39f

                        SHA1

                        1dcc8278ea0ee4d78b5cf907d4abde158a4e528a

                        SHA256

                        5c9cb19b1d4393a960cdcf197c256fc3ebacb11a6d4e1f45d2a6e73ea4fbdd2c

                        SHA512

                        22828415db2ac7504b341a07cf56e13d222ff6e9e1292f5c8ad347a30c85b1d98e2736685474037c4b2eb145b998bebb71ab665cff9b67f54417b8da29abadc0

                      • C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe58529f.TMP
                        Filesize

                        484B

                        MD5

                        ef10cd8063e582c9ca0684debf7f39a3

                        SHA1

                        3898b837b9721925fcef26b528eb783ec2c446a7

                        SHA256

                        1b935541c0b924eadeccc0236e56eea27e8daf59562ca44e8115a15aa04cf621

                        SHA512

                        cb662be48f263d3b8a42ba0e3803aeb0647145ca83eb423781e7202692b673033f7a1c2ace7d6206229216f531444ae9deb957edb171c8f352419b8aa3758230

                      • C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
                        Filesize

                        56B

                        MD5

                        839d5c2710aad326b11beacb27d156b3

                        SHA1

                        26f41df8a03021db77814cbbf74419e0d7e7b66c

                        SHA256

                        a69b6f4d2ed7ddc3e0fb160b8e81eb9c807c694366ee58d562f3c8600bceaf5d

                        SHA512

                        3345f305895fb65aeb9db42f9a15ab0f123b3860390c0afcc556d7b4488b46e46909717117334dd37e6fa08f001da05893f30848ae0fc68b2e2cd87c94e36c9f

                      • C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
                        Filesize

                        16B

                        MD5

                        206702161f94c5cd39fadd03f4014d98

                        SHA1

                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                        SHA256

                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                        SHA512

                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                      • C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT
                        Filesize

                        16B

                        MD5

                        46295cac801e5d4857d09837238a6394

                        SHA1

                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                        SHA256

                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                        SHA512

                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                      • C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-03-16_15-10-31\SpotifySetup.exe
                        Filesize

                        83.5MB

                        MD5

                        5e307b5182474dd37d18cd8ada1a0285

                        SHA1

                        4d70faf2e6e3b0b5a91ecf0470a42bb9afff44cf

                        SHA256

                        5f38b643d1adddd70ae034cb4dd6f567b267c04d7a77e51c6869718630cfee92

                        SHA512

                        e6e249218c46bce48c4e807ef88a81149d456f01e1234d9081525a5f8cb8c0689502315be2ee8c0f5b56572fa696a6474917f34e896f14b9b367feecd44f04da

                      • C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-03-16_15-10-31\SpotifySetup.exe
                        Filesize

                        83.5MB

                        MD5

                        5e307b5182474dd37d18cd8ada1a0285

                        SHA1

                        4d70faf2e6e3b0b5a91ecf0470a42bb9afff44cf

                        SHA256

                        5f38b643d1adddd70ae034cb4dd6f567b267c04d7a77e51c6869718630cfee92

                        SHA512

                        e6e249218c46bce48c4e807ef88a81149d456f01e1234d9081525a5f8cb8c0689502315be2ee8c0f5b56572fa696a6474917f34e896f14b9b367feecd44f04da

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mmalagi3.z5f.ps1
                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      • C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
                        Filesize

                        1.5MB

                        MD5

                        649488d28c18f3626f1f3dc9d51f64e8

                        SHA1

                        62972f8387d9f9ae9a3cf1ad92807915345d4828

                        SHA256

                        bd1c6f44ea8032a2fb5aae336d6b636e84aa46ed2103259f490eb15287b4a3a1

                        SHA512

                        af7f568956388410d8567254d508c8bf50e5a2044a590d85bfc03dffa8e98199bb604c66febd7f8d6a7903ee5e4429ef6cfffe8a297438c82d50f2b62cf514c0

                      • C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
                        Filesize

                        5.9MB

                        MD5

                        c1e6d31a6126f551db2ac66979af8920

                        SHA1

                        4bad19f9028ede7b272921a19492f1fff3bab357

                        SHA256

                        94cc56e44b7b70209a1c61e624ed5e2f96778d5d4d1489773028e6b11dbc9558

                        SHA512

                        60ea1b08ed5a14dfdfe54d9b20dc9572cc9d40ee0b60299ca052b6b0f3e943a480ab9513233a4cef0af92d741afa217237d5df438ee01e2fbefe91afb3c0c4fe

                      • C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
                        Filesize

                        5.9MB

                        MD5

                        0c983ed94f5ca4c740a6cfec5c441c16

                        SHA1

                        b649a7c0b9e52a097e48dedb3fae189caf9ac735

                        SHA256

                        2f1e192d2542d1e1062a536d1c0179b846498b35f8ad9db0ec08f377720eb9d7

                        SHA512

                        ef37d15de454331b0b2954308e06e734ab9b59e2ee5e0cd4e0a9c66ad277c64298ce75e0acc7831cb8874bf126e2ff2ef28683d719b6047c81397ffb5758f8f7

                      • C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll
                        Filesize

                        3.9MB

                        MD5

                        497dca87043d7c5d5bf8a81c61435642

                        SHA1

                        ec0b37632af422e18f507ca1188433efe629035c

                        SHA256

                        0fed010750b6eec9ed7f2d07551bd53a355d07dd10b5a6d90cd4b00cc4229329

                        SHA512

                        71f61c26dd9a54afd48aac109ef9e6bb986ffbee5d7dd8a5c83ca5eef60dffb033ef63ba740914d8a38ca1642e3b19976d7f4103d68206adfbc28d1ad2f1dd83

                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        Filesize

                        18.4MB

                        MD5

                        13dc9f455543556daaeed3b918992789

                        SHA1

                        5c3d8aea2499fa402bc5951dada102ebb776df68

                        SHA256

                        1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

                        SHA512

                        8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        Filesize

                        18.4MB

                        MD5

                        13dc9f455543556daaeed3b918992789

                        SHA1

                        5c3d8aea2499fa402bc5951dada102ebb776df68

                        SHA256

                        1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

                        SHA512

                        8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        Filesize

                        18.4MB

                        MD5

                        6b913160fbaba012204142aa1ab74fd4

                        SHA1

                        cf7878b2dac38f3c686a87ea9b3d99e9ed317162

                        SHA256

                        14ca88c3be66c7c693b0f3959a226578ff695c7c7d0dc47d4f161480b1a1d752

                        SHA512

                        85588ce6eba5a05eec652c5489842b6d3ca608e05e4dbb529551da8f064894992eedc0c7628d4a081d11a9f66132d5d3da25cb8ff09ccd3ac7d43968527bf7fe

                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        Filesize

                        18.4MB

                        MD5

                        6b913160fbaba012204142aa1ab74fd4

                        SHA1

                        cf7878b2dac38f3c686a87ea9b3d99e9ed317162

                        SHA256

                        14ca88c3be66c7c693b0f3959a226578ff695c7c7d0dc47d4f161480b1a1d752

                        SHA512

                        85588ce6eba5a05eec652c5489842b6d3ca608e05e4dbb529551da8f064894992eedc0c7628d4a081d11a9f66132d5d3da25cb8ff09ccd3ac7d43968527bf7fe

                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        Filesize

                        18.4MB

                        MD5

                        6b913160fbaba012204142aa1ab74fd4

                        SHA1

                        cf7878b2dac38f3c686a87ea9b3d99e9ed317162

                        SHA256

                        14ca88c3be66c7c693b0f3959a226578ff695c7c7d0dc47d4f161480b1a1d752

                        SHA512

                        85588ce6eba5a05eec652c5489842b6d3ca608e05e4dbb529551da8f064894992eedc0c7628d4a081d11a9f66132d5d3da25cb8ff09ccd3ac7d43968527bf7fe

                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        Filesize

                        18.4MB

                        MD5

                        6b913160fbaba012204142aa1ab74fd4

                        SHA1

                        cf7878b2dac38f3c686a87ea9b3d99e9ed317162

                        SHA256

                        14ca88c3be66c7c693b0f3959a226578ff695c7c7d0dc47d4f161480b1a1d752

                        SHA512

                        85588ce6eba5a05eec652c5489842b6d3ca608e05e4dbb529551da8f064894992eedc0c7628d4a081d11a9f66132d5d3da25cb8ff09ccd3ac7d43968527bf7fe

                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        Filesize

                        18.4MB

                        MD5

                        6b913160fbaba012204142aa1ab74fd4

                        SHA1

                        cf7878b2dac38f3c686a87ea9b3d99e9ed317162

                        SHA256

                        14ca88c3be66c7c693b0f3959a226578ff695c7c7d0dc47d4f161480b1a1d752

                        SHA512

                        85588ce6eba5a05eec652c5489842b6d3ca608e05e4dbb529551da8f064894992eedc0c7628d4a081d11a9f66132d5d3da25cb8ff09ccd3ac7d43968527bf7fe

                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        Filesize

                        18.4MB

                        MD5

                        6b913160fbaba012204142aa1ab74fd4

                        SHA1

                        cf7878b2dac38f3c686a87ea9b3d99e9ed317162

                        SHA256

                        14ca88c3be66c7c693b0f3959a226578ff695c7c7d0dc47d4f161480b1a1d752

                        SHA512

                        85588ce6eba5a05eec652c5489842b6d3ca608e05e4dbb529551da8f064894992eedc0c7628d4a081d11a9f66132d5d3da25cb8ff09ccd3ac7d43968527bf7fe

                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        Filesize

                        18.4MB

                        MD5

                        6b913160fbaba012204142aa1ab74fd4

                        SHA1

                        cf7878b2dac38f3c686a87ea9b3d99e9ed317162

                        SHA256

                        14ca88c3be66c7c693b0f3959a226578ff695c7c7d0dc47d4f161480b1a1d752

                        SHA512

                        85588ce6eba5a05eec652c5489842b6d3ca608e05e4dbb529551da8f064894992eedc0c7628d4a081d11a9f66132d5d3da25cb8ff09ccd3ac7d43968527bf7fe

                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        Filesize

                        18.4MB

                        MD5

                        6b913160fbaba012204142aa1ab74fd4

                        SHA1

                        cf7878b2dac38f3c686a87ea9b3d99e9ed317162

                        SHA256

                        14ca88c3be66c7c693b0f3959a226578ff695c7c7d0dc47d4f161480b1a1d752

                        SHA512

                        85588ce6eba5a05eec652c5489842b6d3ca608e05e4dbb529551da8f064894992eedc0c7628d4a081d11a9f66132d5d3da25cb8ff09ccd3ac7d43968527bf7fe

                      • C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
                        Filesize

                        599KB

                        MD5

                        d03d4c5ddcdbabe4666bc7a548d20ec6

                        SHA1

                        5055542c06e611e813de5c8ee98fde40b45e8fe7

                        SHA256

                        eb133cd63e7566b3314312704c194d61afcb1c642868f534d0c6a326f524cb0f

                        SHA512

                        163155b2ab0a6b9aeea5155f26467bc3660d13da3693592af3688cbe576ca49afdc655fb1fa372f8e2bff641e1c7c30a777dd344b393c552432104fea8578b75

                      • C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
                        Filesize

                        896KB

                        MD5

                        7e0df0c11087dbd96d7e3211b27db0c4

                        SHA1

                        adf7da811387b31c6a9ef01aba792c696dcd7838

                        SHA256

                        4ee1cfae48ed47a7ca5315c64659385283a57accc1bc9ae24c5fe3d2d28c2603

                        SHA512

                        e357f6aa9a2ab1f09ceed4dcad9c62a252ae31c5797ff135aa8907221465f3d3709aa950b6ea995d66f238b2539661554e8a76ad931de18f4c8e7f67bc44f469

                      • C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                        Filesize

                        1.1MB

                        MD5

                        7b49c99fe56efafc81f9b1cf64671a78

                        SHA1

                        93f33c050541258777804da7446ce431b1601adc

                        SHA256

                        f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

                        SHA512

                        9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

                      • C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                        Filesize

                        1.1MB

                        MD5

                        7b49c99fe56efafc81f9b1cf64671a78

                        SHA1

                        93f33c050541258777804da7446ce431b1601adc

                        SHA256

                        f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

                        SHA512

                        9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

                      • C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                        Filesize

                        1.1MB

                        MD5

                        7b49c99fe56efafc81f9b1cf64671a78

                        SHA1

                        93f33c050541258777804da7446ce431b1601adc

                        SHA256

                        f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

                        SHA512

                        9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

                      • C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                        Filesize

                        1.1MB

                        MD5

                        7b49c99fe56efafc81f9b1cf64671a78

                        SHA1

                        93f33c050541258777804da7446ce431b1601adc

                        SHA256

                        f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

                        SHA512

                        9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

                      • C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                        Filesize

                        1.1MB

                        MD5

                        7b49c99fe56efafc81f9b1cf64671a78

                        SHA1

                        93f33c050541258777804da7446ce431b1601adc

                        SHA256

                        f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

                        SHA512

                        9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

                      • C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                        Filesize

                        1.1MB

                        MD5

                        7b49c99fe56efafc81f9b1cf64671a78

                        SHA1

                        93f33c050541258777804da7446ce431b1601adc

                        SHA256

                        f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

                        SHA512

                        9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

                      • C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                        Filesize

                        1.1MB

                        MD5

                        7b49c99fe56efafc81f9b1cf64671a78

                        SHA1

                        93f33c050541258777804da7446ce431b1601adc

                        SHA256

                        f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

                        SHA512

                        9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

                      • C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
                        Filesize

                        655B

                        MD5

                        e77e36c159d1f61e434f060683728c58

                        SHA1

                        3937b77f65640880a9c9a96c73a254f1dc04b3f2

                        SHA256

                        7a56aa4b4ff4d8a5084dee026a2fb8704fb259d9ce215542bf3b3fc2506fea60

                        SHA512

                        6ac5a648eedd2f81f2fa12f940b018e44dc440d002fff6307b2eaff904be15bb9b08bfe148c4d90376b1f9347ed182611ee8a58eae27444cda43a5aad3655009

                      • C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
                        Filesize

                        3.9MB

                        MD5

                        497dca87043d7c5d5bf8a81c61435642

                        SHA1

                        ec0b37632af422e18f507ca1188433efe629035c

                        SHA256

                        0fed010750b6eec9ed7f2d07551bd53a355d07dd10b5a6d90cd4b00cc4229329

                        SHA512

                        71f61c26dd9a54afd48aac109ef9e6bb986ffbee5d7dd8a5c83ca5eef60dffb033ef63ba740914d8a38ca1642e3b19976d7f4103d68206adfbc28d1ad2f1dd83

                      • C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
                        Filesize

                        10.1MB

                        MD5

                        2c367970ac87a9275eeec5629bb6fc3d

                        SHA1

                        399324d1aeee5e74747a6873501a1ee5aac005ee

                        SHA256

                        17d57b17d12dc5cfbf06413d68a06f45ccf245f4abdf5429f30256977c4ed6de

                        SHA512

                        f788a0d35f9e4bebe641ee67fff14968b62891f52d05bf638cd2c845df87f2e107c42a32bbe62f389f05e5673fe55cbdb85258571e698325400705cd7b16db01

                      • C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
                        Filesize

                        372KB

                        MD5

                        2b1132fc8f12d4fa3ec68a3293f22d0a

                        SHA1

                        ac25afab91399f79e8e6138a0290f1513020571a

                        SHA256

                        b424b7ad12aee02a9de5b6b740ee962df760de6f0d1f04e353ce1269dbf7403a

                        SHA512

                        fef1c6b0ae2829b4aafd12d046aa9506c4df6d4be6165167cb13aaadd3682ef72746ee9aeda40b8acc56691888f36f1005b6b85d161a6b32c9a0fa7730753029

                      • C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
                        Filesize

                        6.2MB

                        MD5

                        9933cb0b99c9651de7832d8fd05b1de0

                        SHA1

                        0e5ddbfbc1f0788a9fbc57e751c8b9ce7e8ec18b

                        SHA256

                        262e337d30ba6c9a64d357ac6511856dab4b546ed47114f509de6f37451134a0

                        SHA512

                        b6f061133a8f7b6edb3287a08e300fcae0b8cee41cee25facb81a4a297e8e3c0e17aa9348c35a6a5cfffaeeb2d8f2205fc7a1ff25a376c699769221cd4505de2

                      • C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
                        Filesize

                        158.4MB

                        MD5

                        15529475ac91826af75d06b6c1ba1ecc

                        SHA1

                        3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

                        SHA256

                        cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

                        SHA512

                        f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

                      • C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
                        Filesize

                        158.4MB

                        MD5

                        15529475ac91826af75d06b6c1ba1ecc

                        SHA1

                        3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

                        SHA256

                        cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

                        SHA512

                        f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

                      • C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
                        Filesize

                        140.3MB

                        MD5

                        802d138a787c4828474325cefd575dfe

                        SHA1

                        17605d4920cc59546d77a490e39b59681c5b58c2

                        SHA256

                        9772c6bafead3b4a0a26611586a4499cadf4e3cd3193a5139442dab04f0615d7

                        SHA512

                        ff5b50f75acd59af79c9331db147f4c9602a1ef12d2c3dd64e8689301e3d3603451a039264f5b3c09551da29b46f2b108ada779e80fbfb97066af2356b36cc9b

                      • C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
                        Filesize

                        89.6MB

                        MD5

                        9a69d1c9b330f607fee6783ddafbf949

                        SHA1

                        1751e7f4539d8d6f459d14eed89c5aef7ab7c82e

                        SHA256

                        83c14fafbb1532c56aa42f9c2db281e8c9bc021fdcf15599a3784d867df5473a

                        SHA512

                        03fc50c0b61352cedf4640101ce23a09edbbe372c6fca461247cda92613b83ff43a1717c65c1203471c01a5ab2440158c1f57995d473c2dfa6048b864a138694

                      • C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
                        Filesize

                        93.3MB

                        MD5

                        ffc589cfd8b9b9cd627e9f80926a1384

                        SHA1

                        7527e2a33f7a71f2d5a7e7fea191249f4d45a9b7

                        SHA256

                        fbbf9acea357974a7e7b12d71f9d825a46a6496f3f7d69f77a233376ca1aa914

                        SHA512

                        2a6a526ad1cc83a45ba1b566cbad6f918a677f38406fd4872a6c75171efc9e994b9745d1cbdca20ae1eb153e48b516983521137c12a83f96c2b8b91f16bcab03

                      • C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
                        Filesize

                        93.7MB

                        MD5

                        9467eea23f9786e59a50319ce530bc9f

                        SHA1

                        5bef35c585d10ef2bab6ab5891af2b163989e7f0

                        SHA256

                        5ee3c394f130fb7f96c56738aadc76a8c699b1cc4b2d0162bf8633ffd3472909

                        SHA512

                        bccc2a93cb50841e0365364cf975b84c1b6ec95124caa44bc27f91a53c442bf258327b6e039a9bdc3ef522d2966f2f4d647e128717bd5b94b4264ac0c92824e3

                      • C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
                        Filesize

                        62.5MB

                        MD5

                        c5576b117a7dc9992afca2d67fbbe049

                        SHA1

                        890736e87ae820819de85068f32eb5d3ba1ce1db

                        SHA256

                        1c7d06918a6b703c871121645deaaebe0c9508fa3227389b4c5a28eac3f5f286

                        SHA512

                        6e053ee596ff8299a6e315706f19e2bb051dcc2a6ab8d9cc6d052df1decb5cc2768ef4490169ed057d62b7ad0518074b02bd52607fdf0b76519afdedfc3e2b65

                      • C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll
                        Filesize

                        372KB

                        MD5

                        2b1132fc8f12d4fa3ec68a3293f22d0a

                        SHA1

                        ac25afab91399f79e8e6138a0290f1513020571a

                        SHA256

                        b424b7ad12aee02a9de5b6b740ee962df760de6f0d1f04e353ce1269dbf7403a

                        SHA512

                        fef1c6b0ae2829b4aafd12d046aa9506c4df6d4be6165167cb13aaadd3682ef72746ee9aeda40b8acc56691888f36f1005b6b85d161a6b32c9a0fa7730753029

                      • C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll
                        Filesize

                        6.2MB

                        MD5

                        9933cb0b99c9651de7832d8fd05b1de0

                        SHA1

                        0e5ddbfbc1f0788a9fbc57e751c8b9ce7e8ec18b

                        SHA256

                        262e337d30ba6c9a64d357ac6511856dab4b546ed47114f509de6f37451134a0

                        SHA512

                        b6f061133a8f7b6edb3287a08e300fcae0b8cee41cee25facb81a4a297e8e3c0e17aa9348c35a6a5cfffaeeb2d8f2205fc7a1ff25a376c699769221cd4505de2

                      • C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
                        Filesize

                        364KB

                        MD5

                        d3368f2e6b469fda055af7a24f4fdb02

                        SHA1

                        841573fc67ca72cd2f37a89d5c8007fa8de0c6f1

                        SHA256

                        81140417f3299086fc358f946c49b96d24bcaff0c09baa3292e24a8b361c0813

                        SHA512

                        96811790b03ed2044241aa9d62069bdfde1bdaa94457c2cb86befc4c29f4db966fb27a45d94349c0110d19d9060fbb916a48fcfe5a517052a4d4fb384cf5922c

                      • C:\Users\Admin\AppData\Roaming\Spotify\locales\es.mo
                        Filesize

                        14KB

                        MD5

                        c10d68e3ebb0f19537de35edf6606a90

                        SHA1

                        520289c9ed5cd5536ba44de463c10e8f97a10920

                        SHA256

                        9f5a6a09ef39a4a9f1ec0d46717b3817f9e0fdc191f7c51a46bb65bc791fe57d

                        SHA512

                        ed13236a5b3a6b5d15f6bb0567c07793f15b86e0a45483d71964465aaeb2dd8c43bfa6aa702ecf67971ba546b7e19e98e871e25633d759599cb1762f7b74045c

                      • C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
                        Filesize

                        7.3MB

                        MD5

                        d74731ce9b252737721129bb55970598

                        SHA1

                        18d25adbe1c2c808d71ead465281bfe3a1d637d0

                        SHA256

                        d9bc680a02d25144c143ff6825ae8f149c9abf85f3894e975de6befed28bea0c

                        SHA512

                        c64bc65632fa523c63bf3843374779d004626c7f121115234b48bcddd56fc731fd11b62c2934f3b6174e6a1df7feace46f9db5335c9add46e3fbc3bad5e72f09

                      • C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
                        Filesize

                        590KB

                        MD5

                        10409a90206eb4859d27095aebf4c392

                        SHA1

                        2a9aa6951c923ccb5ca25348e161ee8799985e7b

                        SHA256

                        2de3925cba036e1eec21eccd40c35e501958938cf9f96bd125e145ba12c446a2

                        SHA512

                        96d7d065ab39d9a1e7850eeb6d23df9da5b0f6e91ea5c6258a06cef3d39c5eeded3117e83cbc1d0a7b0ed73dc656ef0d2b50651bb99800902186b4f1fb1cfd8e

                      • C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
                        Filesize

                        4.3MB

                        MD5

                        4fed87a14384c86689d69875d0c6f9a6

                        SHA1

                        d315cc38b3703bc9935cd5d9604e6ff775243d2e

                        SHA256

                        203b35ef27ca4bdeb8e241b1b58318234460e5ffaeb030f598eacccf542b2552

                        SHA512

                        28614b9516c633a52391ebbb848994d6f23b2720d2e168351648a9625f581b2ae9274be892f1c891d982222ecbcfeb34f3c2d596f63231541eb4dd57bf14c9d7

                      • C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
                        Filesize

                        4.3MB

                        MD5

                        4fed87a14384c86689d69875d0c6f9a6

                        SHA1

                        d315cc38b3703bc9935cd5d9604e6ff775243d2e

                        SHA256

                        203b35ef27ca4bdeb8e241b1b58318234460e5ffaeb030f598eacccf542b2552

                        SHA512

                        28614b9516c633a52391ebbb848994d6f23b2720d2e168351648a9625f581b2ae9274be892f1c891d982222ecbcfeb34f3c2d596f63231541eb4dd57bf14c9d7

                      • C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader_icd.json
                        Filesize

                        106B

                        MD5

                        8642dd3a87e2de6e991fae08458e302b

                        SHA1

                        9c06735c31cec00600fd763a92f8112d085bd12a

                        SHA256

                        32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

                        SHA512

                        f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

                      • C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll
                        Filesize

                        782KB

                        MD5

                        a7d7a64dd61f1b7772d4f3f2fa0e51ea

                        SHA1

                        55076ac2dbdae4677cac689af29a9ec0277aa2fe

                        SHA256

                        bf77cd8a299afdb7a259626423b31f4c4ee7674de5d57e1ba858f79d3ac8af15

                        SHA512

                        1940243ecda51d47aa69b0ae453d36a16d5ae1e22acc2dabce58058c5d0af4f9f4d17b09a95b25e2fc81f3b329dbb4d781c647d731c293ebd5207466dc261ec8

                      • C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll
                        Filesize

                        782KB

                        MD5

                        a7d7a64dd61f1b7772d4f3f2fa0e51ea

                        SHA1

                        55076ac2dbdae4677cac689af29a9ec0277aa2fe

                        SHA256

                        bf77cd8a299afdb7a259626423b31f4c4ee7674de5d57e1ba858f79d3ac8af15

                        SHA512

                        1940243ecda51d47aa69b0ae453d36a16d5ae1e22acc2dabce58058c5d0af4f9f4d17b09a95b25e2fc81f3b329dbb4d781c647d731c293ebd5207466dc261ec8

                      • \??\pipe\crashpad_4744_VVDWXSVHNJPUOHYO
                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      • memory/748-484-0x0000000000400000-0x0000000001690000-memory.dmp
                        Filesize

                        18.6MB

                      • memory/1808-169-0x00000217C5550000-0x00000217C5560000-memory.dmp
                        Filesize

                        64KB

                      • memory/1808-357-0x00000217C8110000-0x00000217C811A000-memory.dmp
                        Filesize

                        40KB

                      • memory/1808-172-0x00000217C5550000-0x00000217C5560000-memory.dmp
                        Filesize

                        64KB

                      • memory/1808-134-0x00000217C5550000-0x00000217C5560000-memory.dmp
                        Filesize

                        64KB

                      • memory/1808-170-0x00000217C5550000-0x00000217C5560000-memory.dmp
                        Filesize

                        64KB

                      • memory/1808-171-0x00000217C5550000-0x00000217C5560000-memory.dmp
                        Filesize

                        64KB

                      • memory/1808-135-0x00000217C5550000-0x00000217C5560000-memory.dmp
                        Filesize

                        64KB

                      • memory/1808-168-0x00000217C7F10000-0x00000217C7F24000-memory.dmp
                        Filesize

                        80KB

                      • memory/1808-167-0x00000217C7980000-0x00000217C798A000-memory.dmp
                        Filesize

                        40KB

                      • memory/1808-145-0x00000217C7700000-0x00000217C7722000-memory.dmp
                        Filesize

                        136KB

                      • memory/1808-166-0x00000217C7EB0000-0x00000217C7ED6000-memory.dmp
                        Filesize

                        152KB

                      • memory/1808-165-0x00000217C7970000-0x00000217C797A000-memory.dmp
                        Filesize

                        40KB

                      • memory/1808-164-0x00000217C7950000-0x00000217C7966000-memory.dmp
                        Filesize

                        88KB

                      • memory/1808-146-0x00000217C5540000-0x00000217C5550000-memory.dmp
                        Filesize

                        64KB

                      • memory/1808-147-0x00000217C7A00000-0x00000217C7B02000-memory.dmp
                        Filesize

                        1.0MB

                      • memory/1808-133-0x00000217C7760000-0x00000217C77E2000-memory.dmp
                        Filesize

                        520KB

                      • memory/1808-148-0x00000217C5550000-0x00000217C5560000-memory.dmp
                        Filesize

                        64KB

                      • memory/1808-355-0x00000217C8720000-0x00000217C88E2000-memory.dmp
                        Filesize

                        1.8MB

                      • memory/1808-356-0x00000217C8E20000-0x00000217C9348000-memory.dmp
                        Filesize

                        5.2MB

                      • memory/1808-149-0x00000217C7910000-0x00000217C7924000-memory.dmp
                        Filesize

                        80KB

                      • memory/1808-358-0x00000217C8590000-0x00000217C85A2000-memory.dmp
                        Filesize

                        72KB

                      • memory/1808-162-0x00000217C7930000-0x00000217C794E000-memory.dmp
                        Filesize

                        120KB

                      • memory/3752-468-0x0000000000400000-0x0000000001690000-memory.dmp
                        Filesize

                        18.6MB

                      • memory/4372-351-0x0000000000400000-0x0000000001690000-memory.dmp
                        Filesize

                        18.6MB

                      • memory/4372-354-0x0000000000400000-0x0000000001690000-memory.dmp
                        Filesize

                        18.6MB

                      • memory/4744-531-0x0000000000400000-0x0000000001690000-memory.dmp
                        Filesize

                        18.6MB

                      • memory/4744-393-0x0000000000400000-0x0000000001690000-memory.dmp
                        Filesize

                        18.6MB

                      • memory/4756-512-0x0000000000400000-0x0000000001690000-memory.dmp
                        Filesize

                        18.6MB

                      • memory/4976-156-0x000001CD752F0000-0x000001CD752F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4976-150-0x000001CD752F0000-0x000001CD752F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4976-161-0x000001CD752F0000-0x000001CD752F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4976-151-0x000001CD752F0000-0x000001CD752F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4976-163-0x000001CD752F0000-0x000001CD752F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4976-152-0x000001CD752F0000-0x000001CD752F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4976-160-0x000001CD752F0000-0x000001CD752F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4976-157-0x000001CD752F0000-0x000001CD752F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4976-158-0x000001CD752F0000-0x000001CD752F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4976-159-0x000001CD752F0000-0x000001CD752F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/5064-412-0x0000000000400000-0x0000000001690000-memory.dmp
                        Filesize

                        18.6MB

                      • memory/5112-475-0x0000000000400000-0x0000000001690000-memory.dmp
                        Filesize

                        18.6MB