a461119f4dcaca45b8438792b6daba9a83d520f47127ebb7a7ed6d68c0ac1008

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Install_New_theme.bat
Size

600B
MD5

99638e3caf39bd8aac3010f291727fcd
SHA1

f688f9f969ffaf78c62f17f8a8df44490b952514
SHA256

a461119f4dcaca45b8438792b6daba9a83d520f47127ebb7a7ed6d68c0ac1008
SHA512

638bdc5e83558daf1c3d14e1ef3669d578ce3bc0df7c4643441e00d1d334397d409bb1329f07d559f0b7de21cfee406abfde24f7bc4d3129f2cf52e53612e84f

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	3632	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 8 IoCs

pid	Process
3132	SpotifySetup.exe
1672	Spotify.exe
2276	Spotify.exe
4024	Spotify.exe
1692	Spotify.exe
3084	Spotify.exe
3480	Spotify.exe
3768	Spotify.exe

Loads dropped DLL 16 IoCs

pid	Process
2276	Spotify.exe
2276	Spotify.exe
4024	Spotify.exe
4024	Spotify.exe
1692	Spotify.exe
1692	Spotify.exe
1692	Spotify.exe
1692	Spotify.exe
1692	Spotify.exe
1692	Spotify.exe
3084	Spotify.exe
3084	Spotify.exe
3480	Spotify.exe
3480	Spotify.exe
3768	Spotify.exe
3768	Spotify.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3632	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\spotify\shell	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe
3632	powershell.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeIncreaseQuotaPrivilege	3632	powershell.exe
Token: SeSecurityPrivilege	3632	powershell.exe
Token: SeTakeOwnershipPrivilege	3632	powershell.exe
Token: SeLoadDriverPrivilege	3632	powershell.exe
Token: SeSystemProfilePrivilege	3632	powershell.exe
Token: SeSystemtimePrivilege	3632	powershell.exe
Token: SeProfSingleProcessPrivilege	3632	powershell.exe
Token: SeIncBasePriorityPrivilege	3632	powershell.exe
Token: SeCreatePagefilePrivilege	3632	powershell.exe
Token: SeBackupPrivilege	3632	powershell.exe
Token: SeRestorePrivilege	3632	powershell.exe
Token: SeShutdownPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeSystemEnvironmentPrivilege	3632	powershell.exe
Token: SeRemoteShutdownPrivilege	3632	powershell.exe
Token: SeUndockPrivilege	3632	powershell.exe
Token: SeManageVolumePrivilege	3632	powershell.exe
Token: 33	3632	powershell.exe
Token: 34	3632	powershell.exe
Token: 35	3632	powershell.exe
Token: 36	3632	powershell.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe
Token: SeShutdownPrivilege	2276	Spotify.exe
Token: SeCreatePagefilePrivilege	2276	Spotify.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2276	Spotify.exe
2276	Spotify.exe
2276	Spotify.exe
2276	Spotify.exe
2276	Spotify.exe
2276	Spotify.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2276	Spotify.exe
2276	Spotify.exe
2276	Spotify.exe
2276	Spotify.exe
2276	Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3632	5072	cmd.exe	83
PID 5072 wrote to memory of 3632	5072	cmd.exe	83
PID 3632 wrote to memory of 4644	3632	powershell.exe	90
PID 3632 wrote to memory of 4644	3632	powershell.exe	90
PID 3632 wrote to memory of 536	3632	powershell.exe	91
PID 3632 wrote to memory of 536	3632	powershell.exe	91
PID 3632 wrote to memory of 3984	3632	powershell.exe	93
PID 3632 wrote to memory of 3984	3632	powershell.exe	93
PID 3632 wrote to memory of 1016	3632	powershell.exe	98
PID 3632 wrote to memory of 1016	3632	powershell.exe	98
PID 4604 wrote to memory of 3132	4604	explorer.exe	100
PID 4604 wrote to memory of 3132	4604	explorer.exe	100
PID 4604 wrote to memory of 3132	4604	explorer.exe	100
PID 3132 wrote to memory of 1672	3132	SpotifySetup.exe	102
PID 3132 wrote to memory of 1672	3132	SpotifySetup.exe	102
PID 3132 wrote to memory of 1672	3132	SpotifySetup.exe	102
PID 2276 wrote to memory of 4024	2276	Spotify.exe	109
PID 2276 wrote to memory of 4024	2276	Spotify.exe	109
PID 2276 wrote to memory of 4024	2276	Spotify.exe	109
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 1692	2276	Spotify.exe	110
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113
PID 2276 wrote to memory of 3084	2276	Spotify.exe	113

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install_New_theme.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-new_theme'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/spotx-official.github.io/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/run.ps1' })} $p """" | iex
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -V
    3⤵
    PID:4644
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -Is -w "%{http_code} \n" -o /dev/null https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.38.720.ga4a70a0e-1222.exe --retry 2 --ssl-no-revoke
    3⤵
    PID:536
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -q https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.38.720.ga4a70a0e-1222.exe -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-05-31_10-46-21\SpotifySetup.exe --progress-bar --retry 3 --ssl-no-revoke
    3⤵
    PID:3984
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-05-31_10-46-21\SpotifySetup.exe
    3⤵
    PID:1016

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-05-31_10-46-21\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-05-31_10-46-21\SpotifySetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    PID:1672

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.38.720 --initial-client-data=0x418,0x41c,0x420,0x410,0x424,0x68aaab74,0x68aaab80,0x68aaab8c
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4024
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/124.0.6367.119 Spotify/1.2.38.720" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,5272935508138703703,8190670461182993635,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1692
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/124.0.6367.119 Spotify/1.2.38.720" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3312,i,5272935508138703703,8190670461182993635,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3084
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/124.0.6367.119 Spotify/1.2.38.720" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3520,i,5272935508138703703,8190670461182993635,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3480
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/124.0.6367.119 Spotify/1.2.38.720" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3876,i,5272935508138703703,8190670461182993635,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
75539b373d7dde7a4a58d15c143f2a1c

SHA1
2996e7b8c53277729b06cdc70605fc5024cd8dbc

SHA256
915d03334dfdfd8e87898ef7726eb0ec023926551df76576fa05177e346ec670

SHA512
5d58bcfb0e4d35cf37fe909851109ffa46e030876463597be2783622f8f190bdfa246b1796ce958981d2a87e06d46e4d291f7a9db06e75a983f85429d18112bc

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
c45671bece0056de4db7bb980f017a66

SHA1
3cf6051f19b97514b077806e66d11446ffe2524a

SHA256
59f1f7199815ef26ffc4e714e558e8019876de6da88a41c5bb412a1fb3551828

SHA512
244ee7ff1b3d6d4e2dd5f7566fef6850b2c2d9f15257025dadb3cdd36e948555c3f0cfae80513560f59de3433f6451f810ce2554654f610fff0f9187ea378235

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State

Filesize
828B

MD5
b797b9bdb0aa4e7996c0b9ff6eca96da

SHA1
e684d2f35f489fe57daa4d8f38208de3b5ecd938

SHA256
8e129837e4c0b99a3d567c13be76dcf615e7f2f483d755125894db09f28b17f5

SHA512
203de5fcfd3fc1742f4a1c1e2f1fa0e364775ff2039fc93bab1dcbca0063cfbe8829281b6715ce0a540e456a087295156be4874e7ab6cbfe79b01e64fc2bf88a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe58c32c.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity

Filesize
524B

MD5
b4d654fff1105c45ad3f8bca62b7d9a9

SHA1
95888328301f9297b9aff33b42ab53bca5928dc6

SHA256
fef127ccb823d429bcb189f029a4b42424b9980634fe96d4162647d28a7e5206

SHA512
8d5b5e5f4bb7b955793649bb5634f4505f568e946a6a52cca20bd57f2c8576a0c349ac461ebd6dca8c9ff5c546f75e37d31190b04de27fc7e74881f3959189bf

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity~RFe58c31c.TMP

Filesize
524B

MD5
19aa6f3bfa376675cbf7b5d5c631d335

SHA1
22313a8b87e9e41045cffb13a400dc3b57288666

SHA256
5cf62ae6ffaa7118260b555385e884d08cf538fb5257e062581eb6b5ad6da648

SHA512
5d98c58b263e28df72977cfe181b65567a5c343b85d808c5790cc0f8b9059390815a86c4582230f4868a33c1d303d2f95f95f8fa2d2887c924a9a27309d3fe67

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
738B

MD5
63787429031b17df0d50baff7ff02691

SHA1
83ec8430091220638771e8f35bbf21dc29c7e018

SHA256
93680768c4d20095be1642034fd9e9e0aca9e70bad776d18141851308d632325

SHA512
82431f2dd8d7a534de9ac46fe6c206598e2d16c1d61027d95fb3401721b5167168d3595d05a6b1e7fc9d8f69fa732cf9a2f6b2ebf68a00f712594f71c271a7ec

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe58bf25.TMP

Filesize
529B

MD5
e431017845c0786f2be6ff2a4191cd52

SHA1
aeff59c2d6cfd17afa6d3f4b0049574abb3506b5

SHA256
0310c4515e53ae61923ba279080f9738fa0e4f65b22cb176320e2486a2951d8e

SHA512
5232c5e09811980e1586fb7e1e90b07f9f4c55412632b2745f4f013ee4f16f2a03047f8f495a616801eb8bd61ff3e6fc931d7fcdc2d552677a72d30efb7449ad

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
9adad63d40e6d363afe2a400b32908fb

SHA1
76832d3a9b77d120b9bea2b826f2024a574d006f

SHA256
7f72d6425b52f568b9ef35fa9fc5190705f17be3890c95de58259c02e42bdbf4

SHA512
e2f7118851b1fe4ede0c09098be7faec6ccde7b8066a78cfda886cb506897d99c28a72edfc5ced21bcef693ab2b7492e0abc84eec4217a9e27627d5a6ecd9468

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ddk1z34q.uur.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
4.4MB

MD5
590e79902d224ddceb533298221b1576

SHA1
ba907c96138b72d991b3f045ef48f55342510693

SHA256
32ced6820509fba8e5bde5ae56614a09317079ba9ca1980c859429b0d267c685

SHA512
deabf85a550176d7cf848c03318aac8764ad7a0493dcc2740c717857670b4d405fc9bb4e6f7361656f88c00eba5d72e73d40da5cca6e983fae218fccb24781da

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
1.8MB

MD5
e78352d335a426024e1e8ad8c05b9d5c

SHA1
79ffcf402b5cfc1a93c2d13b2fc0c4e6fb39082e

SHA256
842202a92c5680259958068d49180b75a28c4530a56e020ee0b93a2c2f4d5171

SHA512
f2afe62fafa52b7589c5ae1a28de394a3d9876b6edf16a7465ed5d5f18349259155e9fc32c6286b90b72ea26e039fad229069b5b9ff7a04b4366ca6f1e868649

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
10.4MB

MD5
9c04ad4e079434a83f157c8de3e2efbc

SHA1
fc33b6e59003d71e61c523722a9f84d886145930

SHA256
02280111fdaeae126a7db05cfc42b0203439f328ecebef70121df0f71dd00985

SHA512
479801b4ba9a85a275ef5e873c56d6e6cf3ddf8d0b47abc2e5296ca384c42d23c62d6d20863600e62cb111b60acf49ebca0670055d5b8267ddf7c30e5627cbbc

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
25.3MB

MD5
0f0d0cfcb9d38533236d621ea7e9710e

SHA1
5601eb1051c104d5b2ab3762934f4a4907394b5f

SHA256
59ccfa1ad31d9928e7552ca74f70bc4ada5ac3cd292725b341632f77f149f433

SHA512
b55e5168ec35a4b3178d5c051e21f404e07c28698bda9793b7c296011f362443b498c51df38d976e819da5b27efa68cf63fc05fbc8f48d1dafa9fcf1833b2bd5

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
25.3MB

MD5
74caccc131c9f30b9c0c44d366d5fd09

SHA1
b60f99719e5eedd2a43ad272c7c4c34c3d4ad461

SHA256
271e1807bee922e0155e14f7ba64add250888a3ed71d8444030d4e7fe91769ae

SHA512
d8bcd392d549df4524908d3473d9ee4f7aebd18a6615f2822424c2d69497724f722ea27d523a219767c09f5352880d4de28f3a7cb4b5ef3feac363e1b7f6085f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
667KB

MD5
ae195e80859781a20414cf5faa52db06

SHA1
b18ecb5ec141415e3a210880e2b3d37470636485

SHA256
9957802c0792e621f76bbdb1c630fbad519922743b5d193294804164babda552

SHA512
c6fef84615fe20d1760ca496c98629feb4e533556724e9631d4282622748e7601225cf19dfb8351f4b540ae3f83785c1bcea6fe8c246cf70388e527654097c1c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
1abf6bad0c39d59e541f04162e744224

SHA1
db93c38253338a0b85e431bd4194d9e7bddb22c6

SHA256
01cb663a75f18bb2d0d800640a114f153a34bd8a5f2aa0ed7daa9b32967dc29e

SHA512
945d519221d626421094316f13b818766826b3bedddab0165c041540dddadc93136e32784c0562d26a420cb29479d04d2aa317b8d605cd242e5152bf05af197e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.0MB

MD5
2a32dfb99f62e5322c2cc23f5f72170b

SHA1
da3d4763d52a346a83f1f8c937e04dfd0f90b1f6

SHA256
2c690cc5ab7bb47f2cb25a3fee66241694b9a00bdddbcf7c7ba02db8dbef59eb

SHA512
0e9fbc983c6a29bd8958eeab1314a7704178cd4e88aec30d4a7d3b39b7f954d552541c6b983bc9a306a2840195185773e1ba6e22be87a7922f1e3f59bcd2c8e0

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
656B

MD5
4ab0f0e9a6a0de1c1b86e2e6a8b8a889

SHA1
508df605e9c842290e595ce5d6129e261c937bdf

SHA256
9375824b8743df108e4de6a23ebeea7f36bf4ecd09e29ad23e96b6b13c6c457a

SHA512
654a43cb6f3817f8aae7d1d6385ba91312ce06551e4c0a935af071b2f3cd89d11c308d579e7776b958ebd639a7c0c4508d6622d034d172c9e93b35b23e4f282b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
1e63d027c411ea60737f83be4b731fdb

SHA1
49a155f5c8dd6b6fca67c2020abdb7383727247e

SHA256
42452f127da6eaf916312cfd585ab37131f0a8d8ad5910e468a07948060cd5c6

SHA512
867f21350c106e5614837ee48950475b48f15d90d0347cdeab7c87a8f7d38262d77c82824030788b3ddccb010e1c5a397b8eb52123df0aefd1036a41944052f0

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.2MB

MD5
74bded81ce10a426df54da39cfa132ff

SHA1
eb26bcc7d24be42bd8cfbded53bd62d605989bbf

SHA256
7bf96c193befbf23514401f8f6568076450ade52dd1595b85e4dfcf3de5f6fb9

SHA512
bd7b7b52d31803b2d4b1fd8cb76481931ed8abb98d779b893d3965231177bdd33386461e1a820b384712013904da094e3cd15ee24a679ddc766132677a8be54a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
369KB

MD5
e69a6c53a971a572f731a32d6db8cbae

SHA1
03b1cfe951bd28564a8255a386697de539f9780d

SHA256
55cf7aabdb6df7234403949068023721c8123f00d4ca9257213c30aaf10c7a2e

SHA512
14790f77cdc524c8338c52615ac7e279c0c1d04b99606a6c0e47f6af20593a4157f8c1d4c83cb24993ddd47dc80da6f475edc8972b081e8c00cdd10e1f5e18df

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
6.6MB

MD5
df5c54d489761eb055f35ea0e2154e29

SHA1
08f10813a15dfabd1de7b051c799c01348e3f6e1

SHA256
854cd81199f6a353b4f2ff6d9fec8a71765972adadc357f8ffa274cd1568701b

SHA512
222e6d4835a20e9daff43da94e6e50d3fa84ef9ec9e24165b914a9f3bc17fe8a2c483ae5ac46c63d040f0c9cf36f5e9489116518b43e4124691d2526c0334418

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
456KB

MD5
0d02c8ac02d1788e337c0e02ca34063b

SHA1
d6ac6fb44838b459233390d3c787bda4416251d9

SHA256
5b4c6c08c41401da4de023b4d611ed817d125565c9bb117fc58e7579def42205

SHA512
a23d473f8cfbb76594b4e6ff60278e86a2aa4d664a041c730b81010e6459b81d7d33cf8510054863d422e47b29148fbca5d3f4861a626451a73539e14e80fd1f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
2cfe980c0024751358360372fe4bc2b1

SHA1
4d926cf61c0e9d27ff847fc3446f049dbd1da192

SHA256
3905cd0af0025adc86548e2f47d68461408a2e2800d66669c9fdf7829c53dee1

SHA512
8bc0f5ee1ded4c693f0e239fdc308626da2d32cf86997d93e000d8c5bd89e42d77a3e058fe548e6f4aeeb5d1e9391f308071bad6b55212500d9dd7cc1bacc6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.0MB

MD5
977b1a602eac2c6f2d7687a3ffb0354f

SHA1
f3eecab519c41ce6507c8c195e195ea215962176

SHA256
a61db929753d37999c4df5a0dacf9f33270c23ef0339fa7589d458fe356d8896

SHA512
0e73b4f401cf8f375e79ad457cce30684a1fba1ff0d350eb5dc6ccb846d2aac4f1703c600f72d436ef85efc0daf1032733f30960b11b15d0f0bb756c731418c8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
643KB

MD5
28477a60b4fbd51dfef5237245817690

SHA1
b0afd5ea9f9d550124f23c65bc7851ddeffc662f

SHA256
169ea86f544e5cdf2a460675f876a9abb7f56bbe122782e94bb03d624931fc12

SHA512
3520658583bb498d5032a7f7ae77195fd2e5f8ed03c6531e56dee8320d8701102a723766e59f7766ab223f837e65a6d85cf862bb2bef6d2755ce45e672a47b22

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.4MB

MD5
5edc40dc4429b0428c50de6b525a7271

SHA1
4feb09f12b0c3d2e96cb8ba24af7d65cf5b5e965

SHA256
7714e48f17648a62e9f38262578475b63c59ae352beb672bd529b4b8bc31f7a7

SHA512
2854cafbed91bb4869d832a2c1a646e43626ce694b3b9964a7e97f9855b0baa223b7904f958ddc7f7f6ee470cfaef4876dabe1006d9f8f4af4ed46b5419a3f2e

Download Submit
memory/1672-225-0x00000000007C0000-0x000000000213B000-memory.dmp

Filesize
25.5MB

Download
memory/2276-540-0x0000000000470000-0x0000000001DEB000-memory.dmp

Filesize
25.5MB

Download
memory/2276-275-0x0000000000470000-0x0000000001DEB000-memory.dmp

Filesize
25.5MB

Download
memory/3632-19-0x0000023576340000-0x0000023576366000-memory.dmp

Filesize
152KB

Download
memory/3632-229-0x00000235765B0000-0x00000235765BA000-memory.dmp

Filesize
40KB

Download
memory/3632-228-0x0000023577AC0000-0x0000023577FE8000-memory.dmp

Filesize
5.2MB

Download
memory/3632-0-0x00007FFB16103000-0x00007FFB16105000-memory.dmp

Filesize
8KB

Download
memory/3632-255-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-221-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-220-0x00007FFB16103000-0x00007FFB16105000-memory.dmp

Filesize
8KB

Download
memory/3632-21-0x00000235763C0000-0x00000235763D4000-memory.dmp

Filesize
80KB

Download
memory/3632-20-0x0000023576310000-0x0000023576336000-memory.dmp

Filesize
152KB

Download
memory/3632-227-0x00000235773C0000-0x0000023577582000-memory.dmp

Filesize
1.8MB

Download
memory/3632-18-0x0000023575F70000-0x0000023575F7A000-memory.dmp

Filesize
40KB

Download
memory/3632-226-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-230-0x0000023577230000-0x0000023577242000-memory.dmp

Filesize
72KB

Download
memory/3632-17-0x0000023575F50000-0x0000023575F66000-memory.dmp

Filesize
88KB

Download
memory/3632-16-0x0000023575F50000-0x0000023575F74000-memory.dmp

Filesize
144KB

Download
memory/3632-15-0x0000023575F50000-0x0000023575F7A000-memory.dmp

Filesize
168KB

Download
memory/3632-14-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-13-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-12-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-11-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Filesize
10.8MB

Download
memory/3632-1-0x00000235750C0000-0x00000235750E2000-memory.dmp

Filesize
136KB

Download
memory/4024-276-0x0000000000470000-0x0000000001DEB000-memory.dmp

Filesize
25.5MB

Download