0c46f4babeb379fc920d7b1326201c0977706504bdea593ed2a7c6586d56b582

Analysis

max time kernel
398s
max time network
400s
platform
windows10-2004_x64
resource
win10v2004-20240412-de
resource tags

arch:x64arch:x86image:win10v2004-20240412-delocale:de-deos:windows10-2004-x64systemwindows
submitted
25/04/2024, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BurntSushi.exe
Size

8.6MB
MD5

64c0351a90a5ac5d88e2ea19265ba545
SHA1

177db3974d47e840abe137659bdc76188576ee94
SHA256

0c46f4babeb379fc920d7b1326201c0977706504bdea593ed2a7c6586d56b582
SHA512

c44ab607308600249bb98ae4cef217724888b98d0478882eb7d121ae47127163b6c6f92237927129a575f597a08399d9c1c1caefd031172f69a5e140ce73f0dd
SSDEEP

98304:Z4/unW9PsFCM9PWeREQTOIAWIyAQLbp+AzCkR:ZcyNEXKLtfR

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
573	3664	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 26 IoCs

pid	Process
5816	SpotifySetup.exe
4348	SpWebInst0.exe
3856	Spotify.exe
2852	Spotify.exe
428	Spotify.exe
4668	Spotify.exe
1440	Spotify.exe
5288	Spotify.exe
1096	BurntSushi.exe
2712	BurntSushi.exe
3564	BurntSushi.exe
4696	Spotify.exe
3176	BurntSushi.exe
4900	BurntSushi.exe
5932	BurntSushi.exe
3672	BurntSushi.exe
5472	BurntSushi.exe
4000	SpotifySetup.exe
3192	Spotify.exe
3504	Spotify.exe
4664	Spotify.exe
2264	Spotify.exe
932	Spotify.exe
5868	Spotify.exe
2332	Spotify.exe
6060	Spotify.exe

Loads dropped DLL 42 IoCs

pid	Process
3856	Spotify.exe
3856	Spotify.exe
2852	Spotify.exe
2852	Spotify.exe
428	Spotify.exe
428	Spotify.exe
428	Spotify.exe
428	Spotify.exe
428	Spotify.exe
428	Spotify.exe
3856	Spotify.exe
1440	Spotify.exe
1440	Spotify.exe
5288	Spotify.exe
5288	Spotify.exe
4668	Spotify.exe
4668	Spotify.exe
4512	MsiExec.exe
4696	Spotify.exe
4696	Spotify.exe
4512	MsiExec.exe
3192	Spotify.exe
3192	Spotify.exe
3504	Spotify.exe
3504	Spotify.exe
4664	Spotify.exe
4664	Spotify.exe
2264	Spotify.exe
2264	Spotify.exe
932	Spotify.exe
932	Spotify.exe
932	Spotify.exe
932	Spotify.exe
932	Spotify.exe
932	Spotify.exe
2332	Spotify.exe
2332	Spotify.exe
4664	Spotify.exe
5868	Spotify.exe
5868	Spotify.exe
6060	Spotify.exe
6060	Spotify.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BurntSushi = "\"C:\\Program Files\\OpenByte\\BurntSushi\\BurntSushi.exe\" --autostart"	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

flow	ioc
156	raw.githubusercontent.com
157	raw.githubusercontent.com
544	camo.githubusercontent.com
547	camo.githubusercontent.com
548	camo.githubusercontent.com
146	camo.githubusercontent.com
151	camo.githubusercontent.com
159	raw.githubusercontent.com
545	camo.githubusercontent.com
142	camo.githubusercontent.com
144	camo.githubusercontent.com
572	raw.githubusercontent.com
573	raw.githubusercontent.com
158	raw.githubusercontent.com
546	camo.githubusercontent.com
147	camo.githubusercontent.com
543	camo.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3856_538925351\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe	msiexec.exe
File opened for modification	C:\Program Files\OpenByte\BurntSushi\BurntSushiBlocker_x64.dll	BurntSushi.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3856_538925351\_platform_specific\win_x64\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3856_538925351\_platform_specific\win_x64\widevinecdm.dll	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3856_538925351\LICENSE	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3856_538925351\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3856_538925351\_metadata\verified_contents.json	Spotify.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5aa809.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0D7D733C-F2F8-425C-BC8B-9554543A4D3F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA8D4.tmp	msiexec.exe
File created	C:\Windows\Installer\e5aa80b.msi	msiexec.exe
File created	C:\Windows\Installer\e5aa809.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003013bddf4a62308e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003013bddf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003013bddf000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3013bddf000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003013bddf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
2324	taskkill.exe
5004	taskkill.exe
6064	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\spotify	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\spotify	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\spotify\shell\open	Spotify.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\burnt-sushi-0.3.1-x86_64.msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Install_Auto.bat:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\BurntSushi.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\SpotifySetup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4452	BurntSushi.exe
1344	msiexec.exe
1344	msiexec.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	64	firefox.exe
Token: SeDebugPrivilege	64	firefox.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe
Token: SeDebugPrivilege	1780	firefox.exe
Token: SeDebugPrivilege	1780	firefox.exe
Token: SeShutdownPrivilege	3856	Spotify.exe
Token: SeCreatePagefilePrivilege	3856	Spotify.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4452	BurntSushi.exe
64	firefox.exe
64	firefox.exe
64	firefox.exe
64	firefox.exe
3856	Spotify.exe
3856	Spotify.exe
3856	Spotify.exe
3856	Spotify.exe
1780	firefox.exe
1780	firefox.exe
1780	firefox.exe
1780	firefox.exe
3928	msiexec.exe
3928	msiexec.exe
3856	Spotify.exe
3856	Spotify.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
4664	Spotify.exe
4664	Spotify.exe
4664	Spotify.exe
4664	Spotify.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
4452	BurntSushi.exe
64	firefox.exe
64	firefox.exe
64	firefox.exe
3856	Spotify.exe
3856	Spotify.exe
3856	Spotify.exe
1780	firefox.exe
1780	firefox.exe
1780	firefox.exe
3856	Spotify.exe
3856	Spotify.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
4664	Spotify.exe
4664	Spotify.exe
4664	Spotify.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
64	firefox.exe
64	firefox.exe
64	firefox.exe
64	firefox.exe
64	firefox.exe
64	firefox.exe
64	firefox.exe
1780	firefox.exe
1780	firefox.exe
1780	firefox.exe
1780	firefox.exe
1780	firefox.exe
1780	firefox.exe
1780	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe
6016	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 4008 wrote to memory of 64	4008	firefox.exe	100
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 3696	64	firefox.exe	101
PID 64 wrote to memory of 2968	64	firefox.exe	102
PID 64 wrote to memory of 2968	64	firefox.exe	102
PID 64 wrote to memory of 2968	64	firefox.exe	102
PID 64 wrote to memory of 2968	64	firefox.exe	102
PID 64 wrote to memory of 2968	64	firefox.exe	102
PID 64 wrote to memory of 2968	64	firefox.exe	102
PID 64 wrote to memory of 2968	64	firefox.exe	102
PID 64 wrote to memory of 2968	64	firefox.exe	102
PID 64 wrote to memory of 2968	64	firefox.exe	102
PID 64 wrote to memory of 2968	64	firefox.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\BurntSushi.exe
"C:\Users\Admin\AppData\Local\Temp\BurntSushi.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4452

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.0.832070015\648077635" -parentBuildID 20230214051806 -prefsHandle 1756 -prefMapHandle 1748 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac52f0bd-b3fc-4acc-920c-f5835d60ac5a} 64 "\\.\pipe\gecko-crash-server-pipe.64" 1836 248ad823e58 gpu
    3⤵
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.1.1787208988\1427885113" -parentBuildID 20230214051806 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1b44e03-52c5-40de-b351-86e6198ce1cb} 64 "\\.\pipe\gecko-crash-server-pipe.64" 2404 248a0a89358 socket
    3⤵
    - Checks processor information in registry
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.2.1924173755\416377925" -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2964 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf7d1aeb-b70f-493c-b363-e7bef102edbd} 64 "\\.\pipe\gecko-crash-server-pipe.64" 2980 248ac894f58 tab
    3⤵
    PID:1308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.3.612086200\950515808" -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9738c23-3d25-46f3-a9e0-f960b56f48c6} 64 "\\.\pipe\gecko-crash-server-pipe.64" 3684 248b23ebe58 tab
    3⤵
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.4.1329045604\1344919301" -childID 3 -isForBrowser -prefsHandle 5200 -prefMapHandle 5196 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66c9d0e2-389d-4498-a8ca-2be502cf447d} 64 "\\.\pipe\gecko-crash-server-pipe.64" 5212 248b444eb58 tab
    3⤵
    PID:5188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.5.428890628\1396046729" -childID 4 -isForBrowser -prefsHandle 5344 -prefMapHandle 5348 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1296f2c-71bd-4cbf-a5de-6de9240e2972} 64 "\\.\pipe\gecko-crash-server-pipe.64" 5336 248b4c7b158 tab
    3⤵
    PID:5196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.6.528644088\1894611554" -childID 5 -isForBrowser -prefsHandle 5540 -prefMapHandle 5544 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9261dd95-9de1-4e73-a85b-bf98d6325452} 64 "\\.\pipe\gecko-crash-server-pipe.64" 5528 248b4c7c658 tab
    3⤵
    PID:5204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.7.2131992913\1816846108" -childID 6 -isForBrowser -prefsHandle 4164 -prefMapHandle 5344 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8f01f8d-0a5d-4cde-91cb-81c5ec981630} 64 "\\.\pipe\gecko-crash-server-pipe.64" 2692 248b5f96558 tab
    3⤵
    PID:6072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.8.1421551276\1491039046" -childID 7 -isForBrowser -prefsHandle 5364 -prefMapHandle 5012 -prefsLen 27962 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c51bead4-621d-4210-bbdf-5989bd26848d} 64 "\\.\pipe\gecko-crash-server-pipe.64" 5016 248b6007f58 tab
    3⤵
    PID:428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.9.1206322222\294443769" -childID 8 -isForBrowser -prefsHandle 4764 -prefMapHandle 5928 -prefsLen 28217 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cfa0331-9b2c-44a4-8e76-bb2c8f0f7904} 64 "\\.\pipe\gecko-crash-server-pipe.64" 5948 248b77dfe58 tab
    3⤵
    PID:1544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.10.1454894768\631963299" -childID 9 -isForBrowser -prefsHandle 10256 -prefMapHandle 10248 -prefsLen 28217 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54838224-2686-4c6f-85db-8fe82c6dfebc} 64 "\\.\pipe\gecko-crash-server-pipe.64" 10232 248b6c7cb58 tab
    3⤵
    PID:5760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="64.11.701274975\957149767" -childID 10 -isForBrowser -prefsHandle 10024 -prefMapHandle 10028 -prefsLen 28217 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15ab771a-ceea-4e9c-b7da-da4aa354135b} 64 "\\.\pipe\gecko-crash-server-pipe.64" 10104 248b6180658 tab
    3⤵
    PID:5924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5280

C:\Users\Admin\Downloads\SpotifySetup.exe
"C:\Users\Admin\Downloads\SpotifySetup.exe"
1⤵
- Executes dropped EXE
PID:5816
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  PID:4348
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3856
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.35.663 --initial-client-data=0x39c,0x3a0,0x3a4,0x398,0x3a8,0x7ffccd866ee8,0x7ffccd866ef4,0x7ffccd866f00
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2852
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/122.0.6261.130 Spotify/1.2.35.663" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1704 --field-trial-handle=1708,i,17783426908782971300,748887765290192963,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:428
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/122.0.6261.130 Spotify/1.2.35.663" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3192 --field-trial-handle=1708,i,17783426908782971300,748887765290192963,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4668
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/122.0.6261.130 Spotify/1.2.35.663" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3972 --field-trial-handle=1708,i,17783426908782971300,748887765290192963,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1440
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/122.0.6261.130 Spotify/1.2.35.663" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3984 --field-trial-handle=1708,i,17783426908782971300,748887765290192963,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5288
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/122.0.6261.130 Spotify/1.2.35.663" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2964 --field-trial-handle=1708,i,17783426908782971300,748887765290192963,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4696

C:\Users\Admin\Downloads\BurntSushi.exe
"C:\Users\Admin\Downloads\BurntSushi.exe"
1⤵
- Executes dropped EXE
PID:1096

C:\Users\Admin\Downloads\BurntSushi.exe
"C:\Users\Admin\Downloads\BurntSushi.exe"
1⤵
- Executes dropped EXE
PID:2712

C:\Users\Admin\Downloads\BurntSushi.exe
"C:\Users\Admin\Downloads\BurntSushi.exe"
1⤵
- Executes dropped EXE
PID:3564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2684
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.0.804503424\1001131941" -parentBuildID 20230214051806 -prefsHandle 1804 -prefMapHandle 1796 -prefsLen 22477 -prefMapSize 235168 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a067360-23cb-4f7c-a063-683e77f65a02} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 1904 19facd20a58 gpu
    3⤵
    PID:4392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.1.946262887\1599405123" -parentBuildID 20230214051806 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 22513 -prefMapSize 235168 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdd353ee-cb48-40e0-bf43-6d7e6c23cd07} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 2452 19f98a8a258 socket
    3⤵
    - Checks processor information in registry
    PID:2332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.2.1359422689\202791280" -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2956 -prefsLen 22551 -prefMapSize 235168 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab803f5f-907a-4c11-bc98-b5bef38cbd48} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 2972 19fafc15f58 tab
    3⤵
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.3.1444836834\1533245684" -childID 2 -isForBrowser -prefsHandle 4092 -prefMapHandle 4088 -prefsLen 28017 -prefMapSize 235168 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73bb999c-8e12-4576-8e7c-ee9d0579b242} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 4100 19f98a3fa58 tab
    3⤵
    PID:4620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.4.876609931\472133598" -childID 3 -isForBrowser -prefsHandle 5040 -prefMapHandle 4896 -prefsLen 28017 -prefMapSize 235168 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22b6ada6-0a2a-4993-96a0-ad99f7da87e1} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 5032 19fb4671c58 tab
    3⤵
    PID:6008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.5.899678311\380575188" -childID 4 -isForBrowser -prefsHandle 5296 -prefMapHandle 5292 -prefsLen 28017 -prefMapSize 235168 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae31336e-385e-4231-8702-8edcd19175d1} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 5308 19fb4670d58 tab
    3⤵
    PID:5636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.6.307452960\857338270" -childID 5 -isForBrowser -prefsHandle 5032 -prefMapHandle 5324 -prefsLen 28017 -prefMapSize 235168 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea293a6c-5adc-4a25-950e-a9b9fd902f5e} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 5192 19fb4671f58 tab
    3⤵
    PID:2276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.7.918375050\815545076" -childID 6 -isForBrowser -prefsHandle 5576 -prefMapHandle 5208 -prefsLen 28017 -prefMapSize 235168 -jsInitHandle 1288 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0b90169-9aee-4320-b67a-5423c5cd0d50} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 5596 19fb5ebf058 tab
    3⤵
    PID:4728

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\burnt-sushi-0.3.1-x86_64.msi"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:3928

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1344
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 33E0DC6064E167447AF74547EE82185F C
  2⤵
  - Loads dropped DLL
  PID:4512
- - C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe
    "C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe"
    3⤵
    - Executes dropped EXE
    PID:4900
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5176
- C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe
  "C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe" --console --install --log-level trace
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:4348

C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe
"C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe"
1⤵
- Executes dropped EXE
PID:5932

C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe
"C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe"
1⤵
- Executes dropped EXE
PID:3672

C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe
"C:\Program Files\OpenByte\BurntSushi\BurntSushi.exe"
1⤵
- Executes dropped EXE
PID:5472

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4984
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.0.823927643\362941013" -parentBuildID 20230214051806 -prefsHandle 1772 -prefMapHandle 1748 -prefsLen 22486 -prefMapSize 235208 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8856791-9f3c-4021-bdd2-5ad22fa39bc5} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 1852 231dc42e358 gpu
    3⤵
    PID:4916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.1.681757002\629504771" -parentBuildID 20230214051806 -prefsHandle 2312 -prefMapHandle 2308 -prefsLen 22486 -prefMapSize 235208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7859a5b1-fb7a-4c98-b29d-022745275471} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 2324 231c8488758 socket
    3⤵
    PID:936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.2.781813752\99215453" -childID 1 -isForBrowser -prefsHandle 3232 -prefMapHandle 3228 -prefsLen 22947 -prefMapSize 235208 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdad0029-67c5-464d-8a89-1afe2af52dca} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 3244 231e012e158 tab
    3⤵
    PID:5376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.3.454918197\1405656534" -childID 2 -isForBrowser -prefsHandle 3668 -prefMapHandle 3664 -prefsLen 28348 -prefMapSize 235208 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {977c6dfc-f83d-4b3a-a0b5-9796855094ad} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 3648 231e158ee58 tab
    3⤵
    PID:2204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.4.2070277424\87672660" -childID 3 -isForBrowser -prefsHandle 5048 -prefMapHandle 5044 -prefsLen 28348 -prefMapSize 235208 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90d0d05b-b036-47dd-91ff-54f8fee5a877} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 5064 231e346b158 tab
    3⤵
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.5.1610354177\1563813677" -childID 4 -isForBrowser -prefsHandle 5204 -prefMapHandle 5208 -prefsLen 28348 -prefMapSize 235208 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f246d61c-85d8-4202-bf33-4bceba25f5c0} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 5192 231e346b758 tab
    3⤵
    PID:3204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.6.446352555\2068929913" -childID 5 -isForBrowser -prefsHandle 5480 -prefMapHandle 5476 -prefsLen 28348 -prefMapSize 235208 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f0054c0-17bf-4f84-8f21-9dbfda69d5e9} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 5488 231e346c358 tab
    3⤵
    PID:3612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.7.2005674377\1079441415" -childID 6 -isForBrowser -prefsHandle 5784 -prefMapHandle 5816 -prefsLen 28348 -prefMapSize 235208 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73c81d88-18b6-44ff-8c60-deb87bb63ba2} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 5808 231c847e558 tab
    3⤵
    PID:4288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.8.1990144775\612164352" -childID 7 -isForBrowser -prefsHandle 4332 -prefMapHandle 3572 -prefsLen 28357 -prefMapSize 235208 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a87f71de-c95f-489c-af8f-279fc773c30b} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 5456 231e511e558 tab
    3⤵
    PID:4600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.9.1386832253\57122273" -childID 8 -isForBrowser -prefsHandle 5108 -prefMapHandle 3828 -prefsLen 28357 -prefMapSize 235208 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db5bb220-c510-47b8-b641-63f1a3338215} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 6100 231e511d058 tab
    3⤵
    PID:3696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.10.1366874538\1999104180" -childID 9 -isForBrowser -prefsHandle 6340 -prefMapHandle 6336 -prefsLen 28357 -prefMapSize 235208 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62c6e676-acc0-4d0d-9e87-edd4d0ac74e9} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 6368 231e5f5ad58 tab
    3⤵
    PID:6084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6016.11.1188345404\325597978" -childID 10 -isForBrowser -prefsHandle 10424 -prefMapHandle 10428 -prefsLen 28357 -prefMapSize 235208 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce092c1f-9eb6-4524-b178-a3a07d5aef0a} 6016 "\\.\pipe\gecko-crash-server-pipe.6016" 10412 231e6a4d658 tab
    3⤵
    PID:6028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Install_Auto.bat" "
1⤵
PID:5760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-confirm_uninstall_ms_spoti -confirm_spoti_recomended_over -podcasts_off -block_update_on -start_spoti -new_theme -adsections_off -lyrics_stat spotify'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/spotx-official.github.io/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/run.ps1' })} $p """" | iex
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:3664
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im Spotify.exe /t
    3⤵
    - Kills process with taskkill
    PID:2324
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im Spotify.exe /t
    3⤵
    - Kills process with taskkill
    PID:5004
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -V
    3⤵
    PID:3184
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -Is -w "%{http_code} \n" -o /dev/null https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.36.955.gd8cc9372-8290.exe --retry 2 --ssl-no-revoke
    3⤵
    PID:5884
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -q https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.36.955.gd8cc9372-8290.exe -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-04-25_20-14-53\SpotifySetup.exe --progress-bar --retry 3 --ssl-no-revoke
    3⤵
    PID:1048
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-04-25_20-14-53\SpotifySetup.exe
    3⤵
    PID:4884
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im Spotify.exe /t
    3⤵
    - Kills process with taskkill
    PID:6064
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4664
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.36.955 --initial-client-data=0x404,0x408,0x40c,0x3fc,0x410,0x75a56b94,0x75a56ba0,0x75a56bac
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2264
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/122.0.6261.130 Spotify/1.2.36.955" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1808 --field-trial-handle=1812,i,5785773473816559642,12555711664582733653,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:932
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/122.0.6261.130 Spotify/1.2.36.955" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3452 --field-trial-handle=1812,i,5785773473816559642,12555711664582733653,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5868
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/122.0.6261.130 Spotify/1.2.36.955" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3544 --field-trial-handle=1812,i,5785773473816559642,12555711664582733653,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2332
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/122.0.6261.130 Spotify/1.2.36.955" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4188 --field-trial-handle=1812,i,5785773473816559642,12555711664582733653,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:6060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2700
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-04-25_20-14-53\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-04-25_20-14-53\SpotifySetup.exe"
  2⤵
  - Executes dropped EXE
  PID:4000
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3192
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.36.955 --initial-client-data=0x418,0x41c,0x420,0x410,0x424,0x75a56b94,0x75a56ba0,0x75a56bac
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5aa80a.rbs

Filesize
9KB

MD5
f85c14f7a0d6f1ee62dfcbd36d30802a

SHA1
3af78df1aa64707e3e949bc20739914221e74ff8

SHA256
225458073dcd1b0433878c717feb1f82e9135e4c18a5e105741a18841ae1b02b

SHA512
9b362caaa1363267a6874b057ad6b621bfac4529a5f8bdbed108c13c253321e041a151aa7afad45b17839cc4926e32255ec51643ff360f4800b201376971db65

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3856_538925351\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3856_538925351\manifest.json

Filesize
1001B

MD5
2648d437c53db54b3ebd00e64852687e

SHA1
66cfe157f4c8e17bfda15325abfef40ec6d49608

SHA256
68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806

SHA512
86d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\activity-stream.discovery_stream.json.tmp

Filesize
28KB

MD5
0fc6e6dac347956c522d9d571f2a60b5

SHA1
cb0a8798055d58eb9c031c9f2205a3196c26a702

SHA256
963effdbd40de0c5ed26e38f53e9de20c950ce9eab5134724eede7ae2e8159e4

SHA512
0cf28fcab5a6025e5892a970806950eecf51aee764600793ab6410d2aa3d5299d98116cca145df95cea7de705432e43987cf742a560f6c9cd5b961256a8108ab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\doomed\19070

Filesize
7KB

MD5
7fc6955e49a7d4b26969ebf5b740e6ed

SHA1
b5df986b77dc158239f7216e35798774fc137e1d

SHA256
d03d41add832ebf1094e576b7c101b415d6b4c983d581b7e34c8bf10017f561a

SHA512
5192c7a104cd933946bd34e4cbc4fc05ed9df7c38e0454a3e7066dc325ef2e8d4bc82643b2dba374c01982baa13cbd059c8502ffb32e7cb80200833e02fcc325

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\doomed\23782

Filesize
10KB

MD5
aa7add00bf8d1d99fc41aede00f6aa01

SHA1
f5e936ef0fde7c9f8d7a10aca6f5c6fb39ca2463

SHA256
39efca4d6d4e63134570e8abc232728be81524a20a05bbc48bed73958e800ae0

SHA512
2d3802d5f179c57cfe02c3f0cacce2dfc19b73ec6d6cb8d24b80e36592bb522b2ac21496a06de2c0c4d61d231197f60263ed1ad952efceff0ee55e4e99989866

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\doomed\28855

Filesize
9KB

MD5
047fad3c9d1a199c05c763b6b3e97024

SHA1
e729f4dc4b570d56cbc88e6a23e86a1f0279fd06

SHA256
dfe543d90f7ebca655f8eeddf4d6d1e6a4bd96bca7098a3aa4fbdda90c43aca2

SHA512
69f224d8aee71ccc14ebb901e4c97a47b28b0602bfe99c8451337a9d89a14c9d145dc48333bef5f2fb091849fdd6462d9825a70c9dd39f88b537af95113b6948

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\doomed\4862

Filesize
9KB

MD5
ff252b7e35ca1c209fcf5a839e5cbc6c

SHA1
e46de6cdc8c01fb523a00dd4cbd7636dbded7aae

SHA256
c389454a83ec3bb4b72a347f416e2fa9163895d44c74c90ab6ee508d974631dd

SHA512
99e5449ef79fb588c677eda71ba6cc11337ca1aeba5e15001b75847c1d2b823ae717733ef2dd592d4fce685f6f667015d142da69f5ed974338c735c67c041d98

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\00CCA4B2C54CA15D4E12886518B690C0ED3D03D5

Filesize
76KB

MD5
3373bcc6549d7d04e9e02430b3cad89e

SHA1
2198682d1a4e82db84ace840aff71fcb212a609a

SHA256
e9681ba48d7ca01d73b9a39275b4657b24c2d1755c119668585c37ed0e3f31b2

SHA512
84ebf1bd02609fd970dc0f2ef05bbf1391facd1972cc3278dd702abd0b56bc9413d9aa996648ce869383cd4998cb6aa8746f19727e9958044b7d7959088934d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\1E54A390B90D38F2251257D886265BF409BF727F

Filesize
15KB

MD5
12babecbac8c1f410a88be23ba6f67f6

SHA1
ce47f74a1a6beb478e5a6805254de3b39ea0d748

SHA256
164fe8712ca347263103352fd036dd4fd69edf24a9b82b9f1c345db67793c113

SHA512
d53425b2759e4178d34ad39b62c8f9f958e8dcdbbd39638b3ea30a38ad8a2770cdbd17ff8926cf525da59c787e6040d4b2b4ac5aa98eff91193b894f3d4cedae

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\274B9AC2A8BAEF84D9463F0FA10BDBC36C49261B

Filesize
25KB

MD5
3b778c5a6b17260b07216f97e5074539

SHA1
9b1cf7ffecad259790d528bac4308497844a8928

SHA256
a263de32b94e156867b5732999e784eefd423f4250321950e8feeb307c56757f

SHA512
5609bc7f8537633bfc37dacdf381146cb6dffb5a2334cc2acd40ad253db355411170eb0239ffb7fdc051e3c964808289e732dc34a90abfce342723dd9f2cb167

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\27F281B8316F24BD964D6C57CF6AF160B08478D7

Filesize
26KB

MD5
8a502936dbbde7335d11b352d586dab2

SHA1
3427f3434294ff046f8dc770e0fce2ba20ea4a1f

SHA256
8186c3c94a6782c75caf9d54e70a9dcf1b624e6a688fb7007742e4368ae61c4a

SHA512
55038abb24f4d2d55f08cbdd98b113fd1209904df6b01c57cc3215bbce7203f4972c4d97ddd7c8b93cd6680200366de475459f6a34e20e84de86a22b2c3ea1ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\36FC5E98764A823029B0E170D6652932ADD6F552

Filesize
17KB

MD5
d71354617882d2c00c20e2025be6b9ea

SHA1
d1b0eb2830fff7a6ee728c693bc8f36ee8413674

SHA256
3db3dcc3f1ee1a4a799a36ee5212630c56d877c71084a1dc2e1a19d9fe9c89c3

SHA512
bda4bed7dd20556da05e8788f1faeb95e2aeabe6a37d20ef2bdae955eb1dee5c063ea595f66a43aec54933cbca8c6a6fcc31c0af68d901c9c9febab9a7f001f9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\5645D75C47974F092087E5F98C2F681689816A00

Filesize
17KB

MD5
5136bd64ad27bd6b5d66530bae60e1db

SHA1
027933efa84a41cb2b7e9e819e49c2b420f64407

SHA256
d5b49e878bdb39577e3f6f54dff59cfd9636a1adea8e2a97973872e0910e9435

SHA512
74bd3e37753f5fcfe444c2a4c6ca6a036c005b1a41dfbe617e653e25ba3115f7376609b43ac75da811a80dedd70dd27bf5cdcadb732a9f2016d4f09f0457e972

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\5ED08E09BD40FBF534818D54EC8E0621861C9E4B

Filesize
17KB

MD5
780b9e25840358e41ebbfa594e2416f2

SHA1
5ad6855430436ec4bae052d8fefc03e876a0fa90

SHA256
b32c5fad275055195c459c4e5cb92fb5c98aef7ff662c2fd4313bdb70bf2cfb0

SHA512
42557dc8dc2c6f9764c64b7deef7000c46a891103ab83834993b9eb45c3c44db6e9c83a7cbf6804405c78c03f8d103abec11490e0a1faa0a6f5cdeb636663c31

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\6FB9BD61D0C1EA8D246E97834C58B9AFE5F78D42

Filesize
16KB

MD5
cd0983fb2863e059fcf6f44f0a91b128

SHA1
f51bf2914d14cdb8dcda01ac78fdb87e3c8e3fb1

SHA256
8b42e80fab976c4e970731e779b3b75c69d452d2e4316133e26476de809bdc58

SHA512
32f968bb6786e1f8962cfcd7013e3734d4e6695247ff51dce3e4d5132feb4f1dd1bcf4a7a6a295aa679c5fba1ac186487ad3121adb70080b7b9541e92f29ff26

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\726A98553846B05D3EEC320CB8D0CE04E2DD5293

Filesize
91KB

MD5
4c0379b75fe28591a2d0012d403b9be7

SHA1
4aa3029d2472e0e4c2e63cb2b17e61c50ad290f3

SHA256
114558e40eaf8abea6e6dd8a906441835bfd99acbe15c2b92d1ce27ddb2c8de5

SHA512
88233f6710a1330eac1f156953caaa7e750386eb48c255d793394a5c1d5a9bd8447e0d3d58073915f805ab72d8a46dd1d48f85ff217a1bc951c3c3de848e1831

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\7614CD67B595B060C64CED6A79777A0F7F437978

Filesize
16KB

MD5
d45a99b8f98174ad2a60403713d35fff

SHA1
621a1bb05354a3d398819baf63aa7a14c60e6226

SHA256
72c80cf6b1c2787cf3e2918ce5f0358aac5d76b99f9422bf7077dfe9d76ec24b

SHA512
0ead632ef78f7e375f255d2f82b054e3d353cdf10a86b63b48234349ca3d2c59072991ca5c0b0b41a541d409e9e0b7b91c294e45364c15b0106fa1a9ec7f1ab5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\792C5CE331FD6F707465BB74F3B8FFDEA265ACF1

Filesize
17KB

MD5
f12b14d4bf9aef7acfc74891045b66f7

SHA1
4b80ff0741f8410350dfbe0b2d636016015046d5

SHA256
ccf0dbf1aa5f9e5a2d939075b5b6442f906876d1b1fd6d7fb840be5ceeb71143

SHA512
020639bf802c88b915902078d347432b0706efba43f11a002e82a707017addadfa00a91e643c87bd8db5e11a62048b3c8b6261ef705c35f4eb3bc4ab4e8505e9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\7CFBD4857A71AFB16B02CC3BD4D3534FD96B1E07

Filesize
30KB

MD5
fbb1e8301842f2345684d8a40bf06d53

SHA1
637d174a14d1f9c90d63be9da4824950cfcbed8c

SHA256
39d4d134592309318c61ed457060ae284d3d6019f48487cbc3ca380d486cf27d

SHA512
a51baba882dae51ddf0399644ef19a21f529cbe5384f1c84b9b01747284590aee743ab5ef57aeee8866cc03eaf9090f0bde1789593ad9712d171c136a2cca77f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\89222D53E2A49BAC3AAE4B49E8A3454061BA640A

Filesize
21KB

MD5
cea47975c8d9436531914853f4dfa341

SHA1
7a3e6a79405435d846e3c465b4d020088b35b266

SHA256
e23738400d5aa169203a655f460dc12c16c7a62e7906375184b9599325b9c4ef

SHA512
ff67731fd45c36ec7e6e15174c95e1247e25cb37fe3df9ed7379b603bd42bcd5d2a9874573dbe5b88b10672814d15683de98c878839e62b29ac164c7de02944c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\9B646A31EC1792658B3810A59359472F9455C911

Filesize
204KB

MD5
d5427b4e80a147e2b7a748c51e96e065

SHA1
7b9158fe1a8fbdaca3c16bbcb9e5c7121fb025b0

SHA256
e947dc0d855b0ab85a0eb49cecea7aae5fbcad40d3577f7de23892501750b822

SHA512
8fa868c84ccc9a8e33a42c5ae41700d83c14fb389258ad948b3d4b1a53c5353611053b2cc0d0097d673a72b24bdb60e6b212c5b1eaf6027740f57e7a504b488b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\A066FBC45D3FFCE2F5C23CB5FCC1810DB6D980E3

Filesize
165KB

MD5
47689dd2b36f8d9546bbe84b9d2cf489

SHA1
3c9bb5ac1a982f3192280b9d0db0fb4ec935ab98

SHA256
87fe73fa0ada66e5a39c24d264c3b147110d69bad0182609a8497dce17392f85

SHA512
8e0d6ea50d21f8ab7be9b96aed5fe34b7f64ab3d6f2f73fdc8130b6a80fa9ec3421a594b732e93a154405ca41ff6a26e508050c0f3dd8632482ea7c81c4563b1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\A18AB3FBE5FC5E1A527BA36FF698DF26A7C382BB

Filesize
13KB

MD5
4a21fe96318f667e6e65839c0d5dffb6

SHA1
264cdb86695c70cca02e03f5c10b36d33fd75c4e

SHA256
2e2e3dd38700fede4874e6833bcd7a66f113381ccec9a969c7c374bb26322c78

SHA512
db4159d2389db06d851818b680a5ff55ab8dce7d03266d94b51b5c9fa3bc78c769f59a557c7bc2496831c6c401753350f7f87d7702d2063bcce3084c829f759e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\A3E42118C8FEB51EE6726015F7933F8796F415C3

Filesize
99KB

MD5
5704814ba08befc982eece955a8ff981

SHA1
f434d090de5cbeeece5e052178f46a7b9bbf9c0b

SHA256
7ddcafae72aa64e7b23e11284475fba2328f9fd2d06777b92c90eed43f653770

SHA512
3bd24749db36eaee7b3549ade1569f980845daa594d2fe8aed72b3e1ba449480d6c91af0120ea96f810aa97ae26db54323a0186957483dc396ec53118c75194c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\A6C74BC2260EAFF823C7AED38BBA607C962CCB55

Filesize
39KB

MD5
a381f14752cc3d3ba8102fd4727735d8

SHA1
d2c1ecf715a4e71b420382754420339bbbd61fdb

SHA256
78cb92e41bb485178b4646b60da71d59938b5870427fde3de948a337d3c72f1c

SHA512
04f9a0a295ced2bd086757e786a929801f00611e421acf1f4252bfd512c78d4f17a971771679f754ff4ca66ab17bd2f94847258b195aead99aef9cc27e2fddd7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\A809C70ECD0BA1FC5DE28D1E6FE9C9430A54261E

Filesize
64KB

MD5
c4962422e7ede3bb01a2040b83005604

SHA1
1929edfd798b980afbf24a4b9c448bbc58cf2fdd

SHA256
42b7cca1016370661bcf6a230d7d82351a764c51204edbd5a0270a05acab0b1c

SHA512
1aa16fd726d01d0e9355a07dd25815a618c0e8d31c10f39844c369ee6064f472af63f332cb5ecfd1bd84ca2cedec8b3a30345e9af0f6c710c8efdd7c1428037c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\A89B6D6E319E3158ECA55D3B441D99B619BC02D8

Filesize
40KB

MD5
932924cb4af705ec639e373d84932858

SHA1
49c6ed2cca3d30542506db1f8f271443ffbd1677

SHA256
1e9cbae9601b8733a5f4206b136724e1aeb5e7fdb2188979806c52e30a888416

SHA512
035301bf2acc2eae17ca8a7a49a93c19866d964102d348ba409f889b7739076727930781fb54b4b79f8523e42e468ff03499a26df73c4fb821cc8f4b30265be6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\B2060B893A99F050270E4C326D129484FE86EF4A

Filesize
16KB

MD5
a42b2dba70006a4bf86bb21822f3fb06

SHA1
e3027380a97a57b3aa6fa77536699c225d71edb4

SHA256
b36e8364bfa9a5219831072a8d670a77200a2ae34c8adf8736bae5d6edce2d37

SHA512
e3c72491d697b346cdbbe608108993c53d9f162df46dbf7dc94b15cc25320a2768c87d85d764a5f2eea260f64f6aa94925697e850bc72e734c10afd9b5eaacde

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C

Filesize
13KB

MD5
2b0cadb64ef153c4445e47153c54d9de

SHA1
7a8b2cfede93ebf39a11e3fdb954dda972784512

SHA256
b120873e0d1cf8f863d27f5ebf4ef3a1238b16356051cf6b4b1b9af31fda37c5

SHA512
4e877c9b704936eb5c27457aabb003cc4788ce9e4227267ffa81ef0dde07ed1be656be703b91c413d0531e033a624c1bfe8b1a89df8e9b6fc5ef9d5b4be0c43c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\CC9AFF3BE02AD27708D587AE49B3DC68644172BA

Filesize
13KB

MD5
f73c3ccfe6c17fc32ffe1ad77aca359a

SHA1
ddcd910f6eacf6ac3767d59f64d0e4b2cb1d5da7

SHA256
134e3bfc347ae2305b5eb4258fc3d38318f1139f53e4c0547496dd6839abb0ba

SHA512
e867da021a5d9b652f6be1b9767e764c55cc96a6a9fcbc1e63e394aa482f0bbb03b848c0633dfd848618002e417818e52c9524e8a54331314a779268499fb39c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\entries\E3D48630B21158F18438BADEF1E66E090FAEF671

Filesize
612KB

MD5
c0241543b97fd2707c89a7ce174e6e03

SHA1
bbcd447acef35d557b0be0fafb7ca9fc676c329c

SHA256
540714efa6e7df1fc94d272bc32ed3f388c744196c4ec5b08ddc07ce86084fb9

SHA512
7f6623e31ef9469ac97d8879375036f62b5f4fb63b17afeca403aab5a3133f0add3e46ef9a3094420783c2ec5a1dae83a44daa79bedd0ea3e49002203007f578

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\index

Filesize
13KB

MD5
bcb42574ae321fd1cc5a54e773bf8159

SHA1
b5aba0336706506aa9bd896e2acbea9f3e7df36c

SHA256
4eb0b9992dc2ad8e91771f98e0987d2567c6d779c8b1a2017d677020de094e4b

SHA512
e32f18fd1f005f217cf733745a014f8d9e2e523a47b7e061c77a190d63c87c1beb0d4388ff8c0e77b3b7b40c8f7eaa6a9283d90034f5e6e58501513db703b05e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cache2\index.log

Filesize
10KB

MD5
d0a379459fe3a22aed25a607c9ae3999

SHA1
6f713efaa8b8b9a4d7be2ad48cc314ddf159363e

SHA256
91ddf1e04b870bb979d4036ca5f3cd28790f9a41ef16767480005f872084450a

SHA512
48163e5f504e6c43093c72bfe5515ab6255c63b8f38781a30d95a3ee5cdb91315fb0f4049aa12101ee3a7107da6842172437b82d609c288535a71bacb654dc5d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
4c70123dfde598f997441f2dd9c8df0c

SHA1
b51f745f5d3a6792ae5f7ef5f8aeca5c1c6bfb5c

SHA256
b34be0e6f2e13ff091870fb64e1cf2616622015ad42646c7e86e28ffe0cb9444

SHA512
3e88b26446f3dd32436b1033653d138670d3788533b455ab60512f9a2419b3f0a946b40f51b4053c7e2674645c37b0f711822e1249268f21ecb3321782b1bbe8

Download Submit
C:\Users\Admin\AppData\Local\OpenByteDev\BurntSushi v0.3.1\BurntSushiBlocker_x64.dll

Filesize
1.9MB

MD5
d5fe5eff69fea1ab97f6c1355e7974e6

SHA1
3be183c42d134d2ccd3333458c5517dd536a72b1

SHA256
f0748701b995ff1259f823aa076db470ac468562c7866eee04a5d72f3c0e33ed

SHA512
61d908eb2728601881efbf43c61199289ccace036f35da0e980b61debe09e981fb8f700c565e68acc8f96cee4a268fea8eea7bf3f40096294f0dcf26ed206f87

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
ebda6457e34b9d970c774e305667c409

SHA1
483625c7c148738539cd2e40ef9ad45611a104d4

SHA256
2dc8459c7eb9245c8c4121dc6062516831c36bf84753d98afde06114f924984e

SHA512
83f853afc7f201c491f730d95390c1f5a1f893d9c30d4c01f98e3d9056061412a7443c3fd64d15ed1e5dc693e1efa07eb691912db10ca2f954d6c67fe3257982

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
e108121f268227fb16e354affc71df3f

SHA1
42cf3511822bd1d26f44fd8dc1e1513f96438da0

SHA256
4ee91fa33e28def8ae0aed2222fbb75e7318d5d21afd6be1c4700fb7ff8272e0

SHA512
28a07afeb2a3ab2e391a7853ca0040dae1162d8a5e888ea2e0ed926a02af0a13b973a91708354e356c0ed233b59496b196016a9540dc51df6793039a9a94ea0c

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\1cf308b4-d19f-4477-9161-9130e5e70f27.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State

Filesize
827B

MD5
e14e1d1836919cdaef469fa787a13160

SHA1
a18a9157cb2603a5d6cdf9c5e0307effcde12028

SHA256
919ec67a83b5fc708a991fd813150f05e6230d495cc53e289139e745d4a41a8e

SHA512
75f1c6095c4e58a2b1cc34f0661b833a84513f7f73389edc6af601ba260db05bfa209cc29a698dfd2969271e9859f52b8722a3ff9ce1f204bac1e2075ef21c34

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe5ac063.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
529B

MD5
dbc10af170408855f840e7a1a6d6efb1

SHA1
7824bb9100f4c57820609b59595808a774f1cf22

SHA256
7d6b53ddd11d3a25bd76133cd70586ca6cbe2ca2230f8cfb3635333ce7cf3919

SHA512
4d293b8e19e4ac3638cff343beb3a28c0e2a2108c04ca9548fd0e0fd384be49bf769c3ac217d41197fac24209ca3212c4ada59fc3c91e29c56e260ad1d29072c

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
738B

MD5
8178aff40e0206db63cf00e0ec9ef245

SHA1
e36eaea815361f612274956a24fa72e2220ff79e

SHA256
651dc27c8f15aa4f045d62b2cff83ba90e18929a181a8b827306c83718944127

SHA512
7eabf3c4b619c2df50467734f9d1bfb777591906f0dead2ef86ec3b93143b75b223c44e0c3567fbe7eeaa9ed3de65351b7d08bc252861564338ed562550f602f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
831B

MD5
6ba1af1194fbcbcaff3c1de96bb9bf18

SHA1
c059a1d26325191b7b8e2c114657f8c0b60ef252

SHA256
26e691b2c7291067320c38a49d243eaa9ab8f3dbebbc31517dcceb6a9f1652d8

SHA512
9d504a961d37482877738f44136cdea329b9dfae810a68414e9dc4ce05b4512cd4596e15d29dd257a0f46db7e01e7d34c1442409364766408a5df71bc68ced5e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
bfa25f129baad834d70bc6009db2145e

SHA1
c255d354771e6b1aad514863f324cae3cd90bb38

SHA256
56ae85421bf87c56cdffa578c5415ced8a7080df856b9af35d196d807356f37e

SHA512
225629287171b7411c729d2e64b586341a6373b67ef7c08bb7f85b0fc667a2a0916332606eaae22c0ca59d98e344c029a5c9c926b2dddcb17d469ab54ed81778

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uszijz2v.khu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\cookies.sqlite

Filesize
512KB

MD5
db185eaf85c7e657d122734f2ca546b8

SHA1
b50a9c2c392336f49e588b2ae556de8e915bc38b

SHA256
80b2712f08d5e16f083ca89c64435f18a9259ce75714c3a98ad4a0fb930e74ea

SHA512
3481af255f21fd4bac1dd7d20208d75b7e567a3e1f263e45bc46433cdfd2837c97739c41cb22d07d7f814c67a4a0680837defad38f4a6f77bfdb96b242e0281d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\crashes\store.json.mozlz4.tmp

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\permissions.sqlite

Filesize
96KB

MD5
25fb1fb4423510990f15d2713c517402

SHA1
a0a2c3b21c65eacb5e29e5bccd955360af3b9298

SHA256
07c1876a0ac1b8600cc257797f72d08eb748be3adf469e24fdbcc15d547e1182

SHA512
4f15a060ab06a935776feaed6d32d258cf84922c37a76f568f5cf44a2ba6bd3dfd077ff9320d55d83ed4fb7cad7a8f7b87011052235390173a6e264cbec181b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\places.sqlite

Filesize
5.0MB

MD5
a7274c044489a7b5d6cf74eed91bccf0

SHA1
2de6965ece1985fc6bc608bf316575949ca2b1b4

SHA256
165eb0c7122949dc8393017cb335ae9fb5f01e884a47963673212245165882f4

SHA512
365968044834c98acb0c7bc20bcf4cd193d82fc716f276605c9ffad72032e2ea348c543757053587450592d4684ed2d2ac4e4c3e1f14cb843361a2d13a5fceae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs-1.js

Filesize
7KB

MD5
2b1a23c13904b58fdeeafe474956fa91

SHA1
08e052cc166a4f68dd0782876cefa995fb276fa1

SHA256
a6ce10040c0b65be2d3681b2c6fdae3102eb9a24ee83906c84969fa0d0100c36

SHA512
e91f0f02287a128d843d1296cd4b834be0af85bd38f40c42582c4f1123c5534e260da1b352098f44621d0b6f6371ca1509be3a7b27dc747809be5fce97490ba0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs-1.js

Filesize
7KB

MD5
6826db0bbed1d59f731c4774582fb713

SHA1
dda5868a5d719640d7f0ce83c5a1bedb2b6a0409

SHA256
0026c7659bb92ca39e8b34ef0752fba7d8e0c8630fcda528a1191e74bd64cfc5

SHA512
681a81f25021604d35111accb00b72d1f4a19ac4af192b352fd66da60bb314d682f468848bbf8a36da618bcc09b589c997634ba9591c36153d8ac411825aa18e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs-1.js

Filesize
7KB

MD5
fabf32ba56ccd6b7984495cc18d16021

SHA1
f1aa16e11b4179ad3c595ac09ab06d17e747dcc2

SHA256
86e921350bd522feeb5174f4df92875803db673c3786bff771347b1a6c799b1e

SHA512
924822fe82ec692298ec8a1db4930e2a32974e1ff94284121840f4671e5aaf58f7da058b32216f38cd5a706e235c3b0badb3d15a1db2186a18d79a2aa09203f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs-1.js

Filesize
7KB

MD5
1b768ee4d218cbfc4bd288e88e480dd7

SHA1
eda9014f04584706440c52a5116d2927daa63208

SHA256
c5415d5d5f331445b8e8af46f62dc90ac42475b4fc7a4e95f8e195397703b951

SHA512
a3e21676407a242f35b59f6d858760f0bf5ef38b090ca672279c41770b62624f41a0d2f08f1e96e1b53041e0a6a2cef2feb34ef98697e666b1700d56155c72df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs-1.js

Filesize
7KB

MD5
e2ff221f78f1ee8fac0408bb16a40af5

SHA1
0ce93a14fb481177fbe1f1853430fcf7e616cea9

SHA256
8c0a77dd04edd8821746cd6da11a9bceeae7d3e1d03aad5c3f8e0de25722d264

SHA512
5d8ff91168f5d67d63130be2eee43307093e6e9502fd72f75a11d76ae660fe8e78b51c671036a4a495e9b9b102bfe40439d2dd50c909480c5cff675ad3cede84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs-1.js

Filesize
8KB

MD5
760c66759b5b95c8fdc66da6faeca862

SHA1
a3b3e2292176b307ce6fb1dda72ed130fd447363

SHA256
c34179f5c3c98b9f2a5bf2fe7eb30b660fdbf298b6cd0b55a41c31f239061be5

SHA512
c96729eab301b8f06334da8537e1fdd18430472c7fe83118f227b40ce8a0d0f59bd2d8f03c854be745d45a6458ab5f425ae4efb6a2a662e9d0ee61073a91bf47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs-1.js

Filesize
7KB

MD5
be5e177f89176d55b89f1ae69f93ba1c

SHA1
817a6f607e6c2ce1959cc3cb5a2a88a7d80bdc56

SHA256
2aeff32d8d16b328145d462fc9eabc5a5f93df9bbacf95b81619e2c3677a1fd5

SHA512
3aec35124a33bb224cb7a0a7a95981924a3be09700c66cc35982fb6809d4a1d7c4dec41a70366687bf40f01e2b1e8ec53238bc4283c27ab1b2bf3246b9d11596

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs.js

Filesize
7KB

MD5
aee9c8b513acdfe267ad8ba89f93e621

SHA1
eddb593f3e0b495a47e9487eb65ec6473202c04e

SHA256
0b9d057307ab408fa3bd53a932bd971ef30044ae24e036641fd61794dac759a9

SHA512
a53dcd4cb9c348e664e3e41bde5bddf3c13bf665d14eec3eab408391a7a247c69f2406d79031c9009ce77d26a143c4ffd59f777ccb7d248085953a64525928f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs.js

Filesize
6KB

MD5
e12d0158c379826c8c6bbec8ae0b9127

SHA1
182dbb24875493817f07a9cd79a8be04d0db2e71

SHA256
968884ccfbd9ca72d9b38fa75e209c2ac72884dea038a54683b7d79e79149010

SHA512
c129e562f32bcc423cb37c8ad9b889ef28f6511890c931780968aca3dcb3ab10b38c929a35a3763fa634fd6f47539cf9e0128c39b60884b8fed4563cf777c1b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionCheckpoints.json.tmp

Filesize
193B

MD5
2ad4fe43dc84c6adbdfd90aaba12703f

SHA1
28a6c7eff625a2da72b932aa00a63c31234f0e7f

SHA256
ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933

SHA512
2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionCheckpoints.json.tmp

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionCheckpoints.json.tmp

Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
b323e700988c2a27fa098451250b23ee

SHA1
8492c3e9d6767fd6d87334b29a6af4618b43d108

SHA256
6f65ecda25695ad94284424880b886143f6d9b9be9ed18350464b7e9e52c9f52

SHA512
4711e5a0535617b9bffed58b33740448f017a69b9fd5d2d5deca5787292098a18431cb9957be5b2e82f920111ae84e4de4e74c19693d3eeaf17bc3798251ee32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
1404be8048282ec6b6fdf4d611fe9170

SHA1
485763d64612a8a9772a1d6e16f4dfd078d69948

SHA256
a312f93dfac92c43334f5d937207115845a68358b1dcfe1a71b1a42fb249b3db

SHA512
2399ecf96fcb287a33a01e8b2e8dcfce094f471809212cfdb17e6be34f26115ef41d84d4271328e8fe8395fcaa880ea308fc2eb36fceaef969c6dd0a5dc00232

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
a86e00360e73c5f02d4672d7b0b808b9

SHA1
1560714bff91f9245c45dba39f1e070cdd7f3743

SHA256
da392d10c53aa71db485c8e54b7426abd2a566a1370483f1f8cbd09a50167467

SHA512
87fc7d7fd4e9ec069e5ef5bde950e274387775c72cf40c903409a1e705b3d4c2fed23693fce5901a85757d85c4ecd7a54a4792c58667b7135fdbaef9f2c64c66

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
11KB

MD5
ea91418142a684931337329094989e24

SHA1
8bab9d42c2c9326f37d3efaf431270b78a2cce03

SHA256
3098e12c07560a551b13adde544b4e75e9d5927629973c72d2d5767e410ef6dd

SHA512
9706b40be05982081522a1c5ae0c19ada3a7faf870541fbd42019625891055efa2f71f458cf3925e696ee53a7f24e91f334159e084a7e8491abf81bb5a61e07d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
14KB

MD5
5db3657dfc2e6c822544746b847e0805

SHA1
94b7d6e505a0449fb8ceb2b7881dc41b731114a3

SHA256
00315fe1dd596698e12ba9dc15dda27482aca6a0f2ca3eb54743e35a496b3bee

SHA512
f97a20624c9c20c85353a90d9f1aaa453a903846d8f1678c83c8b27cd21f73e3ea79b885ecff450efc670e3c5bd571e03fb04c939b63fca5b35ce2f1af2a815e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
fad4e2104e8b3ae60f73ae2dd3062724

SHA1
805a4831da04dba099ce3ee484d144fb4ece098e

SHA256
482a0019219c57523a8a4bdad158dd2244e57cfaaa0a288bcc959097829c3d62

SHA512
c3e90e20bae45b08478edccad0810986d2a8c3ab6b880e11a07daf2b8eb17506013a1ee5ccf28df221a7ad3040ed16fdcef2346c5b4d6a8881b840821ae324ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
f85c0c3da2a9c4b95df7b236223f4b87

SHA1
6eb369ff3d9074b3d31943aa0963fb841952138e

SHA256
47d7b243ff7b14d248f2250a894c2c68950464dd1452586cb34eaa6873ea4471

SHA512
5870f22876c232386f24a385aaaed863e86f7edb78f684fdd50582463722b46507a95b6186457537c30e53c3afba400cb6ef3e11cd8388bf62352f9e06259e59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
2e36a1e3956f38024edaa222cf013647

SHA1
a452448ca331a699b1af92d3d43b101597b5c586

SHA256
508be46c67f518d10a5a8d8aeff04cd7161b774cbe5c9d3b684d8407c638d7d7

SHA512
a5fe58271a90b64d520d609eaf074d5902bae30151bcfafcef52eb962cd2e0cb1e8bff8324003f8a7ea84dc6642a83fef492099ff0896f74beeb935d55e7658f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b85c40bfdddd08a5bc3d57f8302bc9e1

SHA1
47c35abd37c08bd4bdc517caadcecff1cee59641

SHA256
599bb6e0f16e6195c0b7acfff23bde14e84b6ce50cb20ed9e1af7e6b20f9eaad

SHA512
9075dc768bfa6c0ba351080b85ef1071a1055ce2f24616f8f661095046b25d1c939ae5104652d7207720a831870070f8cf98c5c0422dbeca1ed883e1f5a0aa76

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
0085fd76cd69e50736210c6155038930

SHA1
96621aa20591b5fcfeaf4cb2ce1995308290dc9e

SHA256
7c98591378a9dcc208096e7bf96c40d8f8e29db43abbd5d2105096ee8902fe9d

SHA512
e270cd9d95d4bf07b0556fea8d86dcd6fa21e84c9cac11739b0d7d911165c10084a64f6df78ece688570ef3dc7ce5c14d4cd66397ecca741d1405de060cb45ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
17KB

MD5
84d4245ca681c25b07193a43d02e6d2d

SHA1
939ef022713540f136a46f83d9ffad54310b7c53

SHA256
0ddb59a274121a5884727b854ff41dd61644c90d312008526e7750cb748a1686

SHA512
b36880483d558fa3690a570a397a429c142be1d9218b5c32771a715f5869b3a1e80afed8766c2b7fdd7cb7ded8c71611bf063c96b357f9333a414f5903d9f1cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
b895740c2ceddce33ea853be474a0dd1

SHA1
a894833a6cd6708f302d75a9a85e64503d3ebc48

SHA256
7e26e46bd004621c1f486b0aaa7a8b36f27a438f94256e74c85b9d579bbf0e65

SHA512
ace9a79f18cc7d66b465a36302ccf3d9d9a69c9e930227daf75722bbef4e8d078c33a4e62401cccfb485dfb8c605ae73216d07ec839cd92ce85806c0464d5f3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
49f604eabbd2d62423cbcf0a43ca2a08

SHA1
0fb56fe4cc2a03a95a603ae19143b76fb1366304

SHA256
f02bbd15369e2be4e256fcea113c6554cc0ce014c49ab04a8a766e387cc7bacd

SHA512
c139fa728171786124ac96c00dd88d7d05384781510e71c0cd73865b233b6deb87cb0d90014be61caf282486b096872ea27a0c661cfe7759e1c6b8660af135bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
7KB

MD5
5a18665e78559d34789523d4c58fa960

SHA1
715667562c9eea65f51bf152ee669afb03b87b07

SHA256
d141de6e64a595d982faf93d6b226dcdc47d9bdc54acfaa41db68ac2547dcb99

SHA512
bdc999ae95946bc2c3ce8891bdd4905d561195cfb540ddb41987cbaa073b134a71c5fce985cb9b4ae7ee04cf349802a30725b23d758827f99d6c3fa4f058ac87

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
12KB

MD5
f5c578c2a4cdaa5b22ebaba44b3bbbe7

SHA1
25062ec4239e042632603cde505585c61ea9d426

SHA256
cedb7508596f374001df2729abf1c1459304e07d5fdc5172b4b56f9b884aaac0

SHA512
f12e017967763c8ed02daf8ca904f0c57a726bfa306d149b39a3f16a82dd550e5bd28688ddf386d2659c7a462835dd43ba738dd83042da7e86a005133b6ad442

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
9KB

MD5
70427d1f2d729fe0389ae58441c1bff8

SHA1
25aa9ad7cfb8cea3684e589e9ce5341b6c13193b

SHA256
64a8436fe367ebe7fe4c7058bbde05287ae739e1ad79bf419196b643be8c7f08

SHA512
842a8eadfbbd24463018733613871503d901304f585d2bf96c61b08ae58a43501f330c9483f2f66f202bc8801fe382a7597ceefc499d8c865315c470d2d4513e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore.jsonlz4

Filesize
11KB

MD5
588ae7b8e07fdff96d5f302fa6a3076a

SHA1
fb1b567f1d120213840a9344f1eee20b94513133

SHA256
56b09b4f32afbc72b69e06a0d45056c1d4161d98205de120eb7f7d9a8fa05e6e

SHA512
2b7c82f7babf43546727dcd5ade9fe411f7edd2db8fbeb3c6e4bfdaccffb29949637e7b5ff9d451580164ebfd5eddab852e978b414dbb453570a51aa8486130e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
7f12b5ed21974cc2ee9510746d5a31d3

SHA1
aca889383cac8119d5d0eb4eb6a26018b138fc1c

SHA256
191a4a19109cd86ece507829cdcd01a7879603bbafc770cd47a501026ffb3940

SHA512
6fc47c811937aa7705a81d1f2cba2a249b62a36c5095df7bfbd23fabc94a37bb21bab95236ab1277f61d3560cbb5094cf5cfe39f4cd717b71d677172801e0277

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\storage\default\https+++www.reddit.com\cache\morgue\25\{067b7509-8302-4700-81fe-048671439f19}.final

Filesize
2KB

MD5
458d2de1b15816375d733955774b54f3

SHA1
1eef839cf4ededce91dfd4c2890e3dd5e795c7bf

SHA256
19f27b07f1dc509e9bc7f854c5cf98be7d226624e9ebb5d831310ff3f6c4b80c

SHA512
570e5086008092479008d6dce7a32d1ed7dacdb23d9f63f36ed0cbedc9f85c70c5523c6d70d7c4aa9fbdea139bdf48ca37a84226b526136f03c6058a23744261

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\xulstore.json

Filesize
120B

MD5
8d689c06cb844185099c0398a280537e

SHA1
57073c7526ec37e94bb9db44fedc6d50276f7a6b

SHA256
96729e9b38f216605ff10715f96f364be32f02e2de23ede7e74b78244605124d

SHA512
3c7df326c695143915df1068cb2c0f58e93e4881b2c4d94b33948b80e954fbd4cf944ae53b4d15002b79fcdb8e88f8e9cf4c89ca50f56b7cfd8a13ea7dd6fff8

Download Submit
C:\Users\Admin\AppData\Roaming\OpenByte\BurntSushi\BurntSushi.log

Filesize
1KB

MD5
c119628e020edc3e46d481a0e1187961

SHA1
333904d87ae72c47c1fecfe7283f38de641d10a6

SHA256
434254e4c1f5c51802f7df88d3ad1bd25c495dac4e2079053a507b5a41fa8081

SHA512
4e8a0182d0cd1a809d3e2da0b26cd68cdf92970a61d77439bf7ec68bf46d5d2f59807208a0855df95df68713f02c59f644ec01928ebf780b0890c52beb5590a8

Download Submit
C:\Users\Admin\AppData\Roaming\OpenByte\BurntSushi\BurntSushi.log

Filesize
1KB

MD5
c5dbb9271821e264860b5b4974c56996

SHA1
88d9ff361ae358ad9f3c2455ffed601dfa85ca46

SHA256
3f0b61d693fb9b86ec76031547c92d5f4823d6d6e5b27635a4763ce84e3ecf4f

SHA512
d81237b2f255db15d65b0683395ebebb8c6761ddab336164c01f10f3c2f4b439c58a918e6d15050959cdfaf5fbf45bdc6c4a7f162492ea35411b332cba332a5e

Download Submit
C:\Users\Admin\AppData\Roaming\OpenByte\BurntSushi\BurntSushi.log

Filesize
1KB

MD5
85e84fef4144f8ef664e79254ef5a129

SHA1
858979272ba6658948af0cc956e2fe4787a865e1

SHA256
6f3af22451cacd617f28bdd6c7bd62517fe40f82b2e2b5e15b0deaa72586b9f4

SHA512
31a1bab4b7fd9c98680accf30fec0012d37f52bd9a75295d40422d3ec3cfe20dacf6fb589f73dc39f02b57bdb4b98b8a56f495b33fea8c034b640f82810898c2

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
4.2MB

MD5
f4637febfd7d1d088d2d19dacec542a3

SHA1
f4c791a3ddb29b8fd6177f89827380a19038d2b8

SHA256
c6fa80f1471fe5780a39aa86771cb52059a85249f492368682fe4b797240490e

SHA512
d30cc20912a5d4d279ba1525a80d89f23d3482e7d57a1a182421bf7a879a2b4dae79d32e8833c40f4e1d6d8a55804f02259bb52542d5032bea0c44e105c23b39

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
4.4MB

MD5
2f6492c296900c944afbcadaeb8c1062

SHA1
f7b9ad4e3948c84d0c50252dedd1df62de3076a2

SHA256
40b2105e3d77fecaabceffb9c44246a29361548d2f1e073c7e4ed737fbeee2dd

SHA512
f1d61df24243e36a627bd46b1bdd1795396852d748732381aed1c85394d6aaa4d96176140804a29d9bd58c0b3372cdbc9185660b2ce955cc9ff8c6066f45791f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe

Filesize
102.7MB

MD5
e8ace804e23350c768c7ab718bf9b9a8

SHA1
102b203c2bb2e65f8c5c8bb9c7bcb420dfdfdc83

SHA256
40edb75867c2ff8cb4fa6828515974bc6f596fdaeceb6d0463ad5ecd0f7ecf86

SHA512
6deddf4835d714763c97a605c920b1b0a9c4d86fba6ce89ca730f756406089a7b2932e92ed2b790bc4eeef2a752ad095029afeba1b625a55f60da8e7227f2c6e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
32.5MB

MD5
e51d4669aa3cdb112afeeb21f0b5e917

SHA1
1f2cc075c2d09d1fb52c37f82ee10687b4d3af66

SHA256
6269817634e4beb815197f04c7a6692923fa832664b6a7452bac0a8787d47cb4

SHA512
dee3b42639d724ab2188085216a14db74bac19626fa33cf52dbeff143a583d9cadb8e1479559e5da5938d56ce3f48175e62a80459b23dfe3487a2e7d82123679

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
674KB

MD5
fd80a5e69cc456bdcbf71ce4820e950b

SHA1
47d18753f93c0196f1c0595968e31ad5c7359288

SHA256
47e14eb863a9ebec98dfcb99bdbc88f075c71ddc27a17b108e38fd3d70cd5b8c

SHA512
cd3ed3390c3dd2a3f5763e562151ad008f6f0f366f843fba143213c81f1b9b3aebda5d7f24c5b20e3e95993eae6f5995f1a14f3eb635219bda727590a267db50

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
fc1793c3f0b0dbf4557b3a15b2af91f8

SHA1
1e4c3617cfb860c5de8ca15b2bd02c42bc9b3ae0

SHA256
b2c8e8d23ffee4f111ca39cb71757d37eb17d69e04536bc47daa252d97610248

SHA512
b720dc7c30947217b6d97f8861efb5db78d936aac3dc8354f325cd8aa0ee9b983e3774d486384ef1c2fdc227631dc593fc26576ab6a9ca9c019e672efdd0dfda

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.3MB

MD5
7194e72252b601d148820651bb1f102a

SHA1
bf2511a9ad1a1b1db0af8e7a6d7124bc3c31356c

SHA256
29d9efead7e3060e385a125b15b0b79f9ccc2fa7a16216a396855d54dd081b35

SHA512
bafe5843aeb082d9653ae73a57dd4c301f9de22132e2a2a3c9f83588db763b818f5b06bad0eeab3d8759de27cff06d313572a45038a7d6c3055d500ea85f21a8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
681B

MD5
22ac68a977eef47c20d8223ad8d0f357

SHA1
e6e7378738fb14c8d32a63eccce22ae89aa1a668

SHA256
4d87aa94de47ddd198f5bf788d25d5faca1c26c563643dca6e3c4cc7fd37ee59

SHA512
c63506f6ce6c378f3b89dc3ae6af764ede2f2ba6fb2ac368edf430e09f123d2c501b5c98a10e3ededafb34bf44e56da9fa589f1d25b3c310c8c092ea5d0ba11d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
4.7MB

MD5
5aaeb5105e7d2177037523a1462bb10b

SHA1
9bd19904f6fdaaf6a903967025369a8505514976

SHA256
d2b08d81a1853cb88f6c4d6479bc539f4650a2d7a1c37d55a5e7624f91d3043d

SHA512
ca6cea0262cb3fbc67f25e41048f0ccd2402df586f9474adfea032d8f982d2f9ac5a0897ccf6ece7a68a7c3da8f3487cc797eaee35859963bb3a87a425754fec

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
469KB

MD5
38a17a251e6e55ced2b23f111d0abdae

SHA1
5fbba7695eb8aed7821ae3e60d453cfccdd0109e

SHA256
c761a51936044b60f0aebea63e9f4ef51c1ad9584e635290a88dd1424a72306d

SHA512
ab45ef0fd5e9b535990f26d8eebacab4f3d167a7adbcfd4686a38fdf6e1abaf940a4fb99a003130140492ccf431ec55b1290e4b24168065075a86c49ebfe4b6f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
202.5MB

MD5
4b70da492257d4f7040ff3ad10b3a295

SHA1
aea68a0f6a8acde203149cc6d056455084cd3531

SHA256
2b392180d3c5eea427af5dfbf1e6fe3d3b0a426254e01580f9209e155b2e6cb9

SHA512
5f829ea978e3b7242b25bb4d44b17064174dae8ff16b1633c574a9a2e643e587cf4b8d8c97e706d75e23120c3177d470408623e12800c3ed5ecf77efdd1a4619

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
7.2MB

MD5
a459ff150ac63b56f09520247897fe3f

SHA1
b78b597650b331fac74eaaa05568d7684147feed

SHA256
c2339221cf0628e4b68daf282eedb1bb3db6e5dc373c96a59db4b7777e9b2e84

SHA512
23298d43251b2d98501a1fd033629538b9381717e4991f159c16bee489027e4030b2e200a21f003bf33de1e2a579d9e9ca64205d7655c898b29f8e9efcb80542

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\de.mo

Filesize
16KB

MD5
7da138d511a12280fc45d829138f1bb1

SHA1
483cf02d8a8561041665496dc1ca1535e2d7bbbb

SHA256
abfda700f5baa96f69eafb26fc8e3e20f717a52a711e5e256f5576c7dc0c9ca3

SHA512
85ee96845d2a55465ddde9785c6a7382fe65c2ea7260f2e67fc174065f70a0cf4f532e50b537d690532d5353163800b4c9cbc81b40f7371a711577c0a303a237

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
453KB

MD5
f84565eb0cc0ec6abe77e5aa78162c80

SHA1
fc0272e74be210c777954e7d9f5bba9f53744048

SHA256
6c88ac7f748a8a97c6b4c6aa736b20bbc9bb2ddc2aa9f3a4afeefe6f29ee7d98

SHA512
0a3ce121bcbdc806f1d8865bac735356e2f5ba06b7cd5633109343662d24e0d8e8625deba5d760710cccf5135da3d3622d726911e22d7071235a35c8332b436b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\prefs.tmp

Filesize
154B

MD5
808cb055144d088e0ff9239b7bb86221

SHA1
dda1aa4f673fc368a25d91998531602f1c130267

SHA256
7a95b1afa1bf788e7b15201b660d111bc5a0ffdbef21255150b88c11cab185e9

SHA512
c5396e57da71a44464c329c5a5f2873964bf94df580b75e1183af0cfd54315a4a66a5b743ebd49fb761151bd8f833be635a2e46a7c2ee8b5297257a5825c9c52

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
7.8MB

MD5
5ffc04378a5dd8db61c8cb09a407b773

SHA1
4b6466498918d25ef8ff60632d9265d0108af925

SHA256
6dd72487195ac2cc0e35918f41d8fc599296c61a69947db083bce536b9b3976c

SHA512
6d03a1eb6a8a90740a910944cba4903fa1e05dbd07f2adc53f89eb37e75f377e4dad2ac5bbdd9fa09885112301d30296f72ceeac45379dfe4c0b434b27211492

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
670KB

MD5
192168beaa7259b1fb19ea4a74fb7147

SHA1
d5a5985008666d9b8781a2586133d6dad17020ba

SHA256
eba226dd1134a48607dbb0410696d597c0f626c3ff5359a4d58643b76ec2a10c

SHA512
cb7320c338d1bcea8a04d06efd06e93b8837abddea7a2f5e006cc00efe3b5aea55820647e6a404bd996fc72addd40fc701c030b0bfe7d6384f476490e50fbc39

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.9MB

MD5
9670c7b9ecd1b5bc78a5dab34659d961

SHA1
36165708cd4ee3cc34225f3cf0d5ba2e7f5019d6

SHA256
6511dfbe4ddd8053ed5ae5e9da2f387b6217fc317d5a94c47c1253198ea2dacd

SHA512
decf3572c3817510f686c5100ce8ef1eae212430989c009f0b65148187443ee986c4aa7f9d3ea5cea9cf03f30001502030756e82c89615a2d123455637717ce4

Download Submit
C:\Users\Admin\Downloads\33H_2L28.bat.part

Filesize
740B

MD5
a9a92cac1ecc3d9e1fa51908dd9113f3

SHA1
e43c6c2b6a9891a191681804c1b51f55b8391266

SHA256
43a0318d6069ca13bbe7d6a8fb28cf071229953ec21266cfe4940dd5af02699d

SHA512
dc1ebbe59f5591499cc64be46b9ec5778cf38d0c1ea4ea7896ba6612f7b7de48db753e4ba421407b66d4b20ab46f95da4c82d63b73d45918e559184c4c4c20a4

Download Submit
C:\Users\Admin\Downloads\BurntSushi.LKRgguS8.exe.part

Filesize
17KB

MD5
7f83b162fcb2aa9642c219d55cd81238

SHA1
57b3c99f5d160ab826b10e4ed4fdd4701ecd16e7

SHA256
0ebb6534fb8ad67cddac44a12ea00c6ab0645758875894ac126bdbd80f84b4aa

SHA512
113fa0b59228e506bab53037e6d66d1da7eb0d351f757a0b929a34e9e860977f9db53abfa3a44ba3eee0266d5085e770e939be88004ffe067e18ecb5460e26fc

Download Submit
C:\Users\Admin\Downloads\BurntSushi.exe

Filesize
8.6MB

MD5
64c0351a90a5ac5d88e2ea19265ba545

SHA1
177db3974d47e840abe137659bdc76188576ee94

SHA256
0c46f4babeb379fc920d7b1326201c0977706504bdea593ed2a7c6586d56b582

SHA512
c44ab607308600249bb98ae4cef217724888b98d0478882eb7d121ae47127163b6c6f92237927129a575f597a08399d9c1c1caefd031172f69a5e140ce73f0dd

Download Submit
C:\Users\Admin\Downloads\SpotifySetup.KUearNzS.exe.part

Filesize
16KB

MD5
04e41a964d807f68c4bc0cc49203dc7e

SHA1
69fd1576627eafcf35c79abf27003b02e8cb1853

SHA256
e29bd609268709f34dc50e245608473db5e0690e710e177b0d7e8b90d9c22437

SHA512
a30692787c77da56b8f91ec715223a7897558fafe6bc70bffb2cfa120d4b5a98f383311eb8ede245cf212ea7bb4cebdf67430f113057f71797281bbfa90483f2

Download Submit
C:\Users\Admin\Downloads\SpotifySetup.exe

Filesize
998KB

MD5
56b41fc48c9b15ab6cd0cc1719128f12

SHA1
7430a61172968251344a000b7c3b678e9eb32dcb

SHA256
f0c87c715fca1a30cbe78b87ba650dc3390d09dbed199eec4ac33c087846573e

SHA512
532a61ccf73d650e99ea94054f6273b6b31283283e4f1c8cc28afc321129e8fcdf629d680872582be850ffc9c1e813e9c1a8829463e40a830cb6fd39e8d821e9

Download Submit
C:\Users\Admin\Downloads\burnt-sushi-0.V_3Dlp4t.3.1-x86_64.msi.part

Filesize
383KB

MD5
c4ca651c0d286d68014f9e9fb5e2463e

SHA1
2678e1958e0a6c92b7fcf4d9a0e99a994422edf1

SHA256
a33541530b8a831bedb8f0433aab2eed8f674262624c8bf8197bdb9d82218be5

SHA512
71143ff101532ba876a11a2476e2d0557a88e24044b5bda5aeeb71556bf3f3120d83a91ca85a9f0bc91e7438560e5b8482a6ac97991556365106f231fa73b31a

Download Submit
memory/428-1576-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/428-1443-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/932-3757-0x00000000006C0000-0x000000000200D000-memory.dmp

Filesize
25.3MB

Download
memory/1440-1520-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/1440-2031-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/2264-3728-0x00000000006C0000-0x000000000200D000-memory.dmp

Filesize
25.3MB

Download
memory/2332-3807-0x00000000006C0000-0x000000000200D000-memory.dmp

Filesize
25.3MB

Download
memory/2852-1413-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/3192-3259-0x00000000006C0000-0x000000000200D000-memory.dmp

Filesize
25.3MB

Download
memory/3192-3257-0x00000000006C0000-0x000000000200D000-memory.dmp

Filesize
25.3MB

Download
memory/3504-3262-0x00000000006C0000-0x000000000200D000-memory.dmp

Filesize
25.3MB

Download
memory/3664-3060-0x00007FFCC9B50000-0x00007FFCCA611000-memory.dmp

Filesize
10.8MB

Download
memory/3664-3267-0x0000018C7CEF0000-0x0000018C7CF02000-memory.dmp

Filesize
72KB

Download
memory/3664-3024-0x0000018C7C0A0000-0x0000018C7C0B0000-memory.dmp

Filesize
64KB

Download
memory/3664-3025-0x0000018C7C350000-0x0000018C7C454000-memory.dmp

Filesize
1.0MB

Download
memory/3664-3026-0x0000018C7C050000-0x0000018C7C066000-memory.dmp

Filesize
88KB

Download
memory/3664-3027-0x0000018C7C0A0000-0x0000018C7C0B0000-memory.dmp

Filesize
64KB

Download
memory/3664-3029-0x0000018C7C0A0000-0x0000018C7C0B0000-memory.dmp

Filesize
64KB

Download
memory/3664-3030-0x0000018C7C280000-0x0000018C7C2AA000-memory.dmp

Filesize
168KB

Download
memory/3664-3031-0x0000018C7C280000-0x0000018C7C2A4000-memory.dmp

Filesize
144KB

Download
memory/3664-3032-0x0000018C7BDD0000-0x0000018C7BDD8000-memory.dmp

Filesize
32KB

Download
memory/3664-3022-0x00007FFCC9B50000-0x00007FFCCA611000-memory.dmp

Filesize
10.8MB

Download
memory/3664-3041-0x0000018C7C2A0000-0x0000018C7C2B6000-memory.dmp

Filesize
88KB

Download
memory/3664-3042-0x0000018C7C280000-0x0000018C7C28A000-memory.dmp

Filesize
40KB

Download
memory/3664-3043-0x0000018C7C310000-0x0000018C7C336000-memory.dmp

Filesize
152KB

Download
memory/3664-3044-0x0000018C7C2E0000-0x0000018C7C306000-memory.dmp

Filesize
152KB

Download
memory/3664-3045-0x0000018C7C840000-0x0000018C7C854000-memory.dmp

Filesize
80KB

Download
memory/3664-3719-0x00007FFCC9B50000-0x00007FFCCA611000-memory.dmp

Filesize
10.8MB

Download
memory/3664-3374-0x0000018C7C0A0000-0x0000018C7C0B0000-memory.dmp

Filesize
64KB

Download
memory/3664-3254-0x0000018C7C0A0000-0x0000018C7C0B0000-memory.dmp

Filesize
64KB

Download
memory/3664-3021-0x0000018C7BD80000-0x0000018C7BD90000-memory.dmp

Filesize
64KB

Download
memory/3664-3258-0x0000018C7C0A0000-0x0000018C7C0B0000-memory.dmp

Filesize
64KB

Download
memory/3664-3016-0x0000018C7BDE0000-0x0000018C7BE02000-memory.dmp

Filesize
136KB

Download
memory/3664-3010-0x0000018C7C0B0000-0x0000018C7C136000-memory.dmp

Filesize
536KB

Download
memory/3664-3263-0x0000018C7CEA0000-0x0000018C7CEEA000-memory.dmp

Filesize
296KB

Download
memory/3664-3264-0x0000018C7D0C0000-0x0000018C7D282000-memory.dmp

Filesize
1.8MB

Download
memory/3664-3265-0x0000018C7D7C0000-0x0000018C7DCE8000-memory.dmp

Filesize
5.2MB

Download
memory/3664-3266-0x0000018C7CE70000-0x0000018C7CE7A000-memory.dmp

Filesize
40KB

Download
memory/3664-3023-0x0000018C7C0A0000-0x0000018C7C0B0000-memory.dmp

Filesize
64KB

Download
memory/3664-3280-0x0000018C7C0A0000-0x0000018C7C0B0000-memory.dmp

Filesize
64KB

Download
memory/3664-3275-0x0000018C7CF10000-0x0000018C7CF2E000-memory.dmp

Filesize
120KB

Download
memory/3856-1513-0x000001D9C7390000-0x000001D9C7391000-memory.dmp

Filesize
4KB

Download
memory/3856-1488-0x000001D9C7390000-0x000001D9C7391000-memory.dmp

Filesize
4KB

Download
memory/3856-1983-0x000001D9C7390000-0x000001D9C7391000-memory.dmp

Filesize
4KB

Download
memory/3856-1502-0x000001D9C7390000-0x000001D9C7391000-memory.dmp

Filesize
4KB

Download
memory/3856-2004-0x000001D9C7390000-0x000001D9C7391000-memory.dmp

Filesize
4KB

Download
memory/3856-1494-0x000001D9C7390000-0x000001D9C7391000-memory.dmp

Filesize
4KB

Download
memory/3856-1505-0x000001D9C7390000-0x000001D9C7391000-memory.dmp

Filesize
4KB

Download
memory/3856-1516-0x000001D9C7390000-0x000001D9C7391000-memory.dmp

Filesize
4KB

Download
memory/3856-2025-0x000001D9C7390000-0x000001D9C7391000-memory.dmp

Filesize
4KB

Download
memory/3856-1982-0x000001D9C7390000-0x000001D9C7391000-memory.dmp

Filesize
4KB

Download
memory/3856-1540-0x00007FFCEC260000-0x00007FFCEC261000-memory.dmp

Filesize
4KB

Download
memory/3856-1563-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/3856-2068-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/3856-1394-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/4664-3716-0x00000000006C0000-0x000000000200D000-memory.dmp

Filesize
25.3MB

Download
memory/4664-3777-0x000000000D5C0000-0x000000000D5C1000-memory.dmp

Filesize
4KB

Download
memory/4668-1577-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/4668-1491-0x00007FFCEAEF0000-0x00007FFCEAEF1000-memory.dmp

Filesize
4KB

Download
memory/4668-1495-0x00007FFCEB5C0000-0x00007FFCEB5C1000-memory.dmp

Filesize
4KB

Download
memory/4668-1504-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/4696-1819-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/4696-1851-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/5288-1587-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/5288-1517-0x00007FF618530000-0x00007FF61A5E8000-memory.dmp

Filesize
32.7MB

Download
memory/5868-3803-0x00000000006C0000-0x000000000200D000-memory.dmp

Filesize
25.3MB

Download
memory/6060-3817-0x00000000006C0000-0x000000000200D000-memory.dmp

Filesize
25.3MB

Download