f56a1f2ddcc44699d397d3700482cbca85ad8104603fd8e0133f79fca5efd3bf

Resubmissions

06/08/2024, 01:04

240806-be2e1ayaqe 6

06/08/2024, 00:50

240806-a7a8vaxgkd 8

06/08/2024, 00:48

240806-a5tbmstfnk 6

06/08/2024, 00:42

240806-a2lgmatenn 6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpotifySetup.exe
Size

909KB
MD5

6d2f652dfe8001c0caf6aa246a418124
SHA1

d1d5f533b5b514d7d863541974367e3ed86f8bfc
SHA256

f56a1f2ddcc44699d397d3700482cbca85ad8104603fd8e0133f79fca5efd3bf
SHA512

9a8faae6e532702ab0b79863ff1bf490ef8a3e8d5052c2082a2d1426cef171de22ebb895ffb6b6b2173940bbfa89b4c4702966318acc6c5d5e53cd72aa67b39f
SSDEEP

12288:O8PTZuEHn+AgZZpi7xTICP4AC0laDi6u5DUCuUhO:O8PTwEwZpi7xT3/lauB5DUys

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2800_269107454\manifest.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2800_269107454\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2800_269107454\manifest.fingerprint	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2800_269107454\_platform_specific\win_x86\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2800_269107454\_platform_specific\win_x86\widevinecdm.dll	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2800_269107454\LICENSE	Spotify.exe

Executes dropped EXE 9 IoCs

pid	Process
4576	SpWebInst0.exe
2800	Spotify.exe
3040	Spotify.exe
3388	Spotify.exe
3812	Spotify.exe
2088	Spotify.exe
1164	Spotify.exe
4572	Spotify.exe
4368	Spotify.exe

Loads dropped DLL 21 IoCs

pid	Process
2800	Spotify.exe
2800	Spotify.exe
3040	Spotify.exe
3040	Spotify.exe
3388	Spotify.exe
3388	Spotify.exe
3388	Spotify.exe
3388	Spotify.exe
3388	Spotify.exe
3388	Spotify.exe
2088	Spotify.exe
2088	Spotify.exe
3812	Spotify.exe
3812	Spotify.exe
1164	Spotify.exe
1164	Spotify.exe
4572	Spotify.exe
4572	Spotify.exe
4368	Spotify.exe
4368	Spotify.exe
4368	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpotifySetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpWebInst0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	Spotify.exe
4368	Spotify.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe
Token: SeShutdownPrivilege	2800	Spotify.exe
Token: SeCreatePagefilePrivilege	2800	Spotify.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2800	Spotify.exe
2800	Spotify.exe
2800	Spotify.exe
2800	Spotify.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2800	Spotify.exe
2800	Spotify.exe
2800	Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4576	4588	SpotifySetup.exe	86
PID 4588 wrote to memory of 4576	4588	SpotifySetup.exe	86
PID 4588 wrote to memory of 4576	4588	SpotifySetup.exe	86
PID 4576 wrote to memory of 2800	4576	SpWebInst0.exe	87
PID 4576 wrote to memory of 2800	4576	SpWebInst0.exe	87
PID 4576 wrote to memory of 2800	4576	SpWebInst0.exe	87
PID 2800 wrote to memory of 3040	2800	Spotify.exe	88
PID 2800 wrote to memory of 3040	2800	Spotify.exe	88
PID 2800 wrote to memory of 3040	2800	Spotify.exe	88
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3388	2800	Spotify.exe	90
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93
PID 2800 wrote to memory of 3812	2800	Spotify.exe	93

C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe
"C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Adds Run key to start application
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.43.420 --initial-client-data=0x40c,0x418,0x41c,0x408,0x420,0x7471eb74,0x7471eb80,0x7471eb8c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3040
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,9870452586685812996,8245004415456631234,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3388
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3348,i,9870452586685812996,8245004415456631234,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3812
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3468,i,9870452586685812996,8245004415456631234,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2088
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3960,i,9870452586685812996,8245004415456631234,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1164
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=4660,i,9870452586685812996,8245004415456631234,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4572
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1340,i,9870452586685812996,8245004415456631234,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1028 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2800_269107454\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping2800_269107454\manifest.json

Filesize
984B

MD5
0359d5b66d73a97ce5dc9f89ed84c458

SHA1
ce17e52eaac909dd63d16d93410de675d3e6ec0d

SHA256
beeab2f8d3833839399dde15ce9085c17b304445577d21333e883d6db6d0b755

SHA512
8fd94a098a4ab5c0fcd48c2cef2bb03328dd4d25c899bf5ed1ca561347d74a8aab8a214ba2d3180a86df72c52eb26987a44631d0ecd9edc84976c28d6c9dc16a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
9e0be2298ff24abe6b3aaecadceac443

SHA1
8b9a16d29aa3de1e8a80bffb643af308c1c8e22d

SHA256
f58f19fe09241bca1b07bf4151006d203f2a28b1f8dde5dcf74e959e231deacf

SHA512
6a7ab7b18b6fca23423c1f10966a0e12cfd107db86a0993507bb8ebcf05e4473503dfece595c30fce5be945efc684d78b48626cf6c70b96709aca13a6a1ba74b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
62a8707a3b41a84f45bbe3d3f9be9b00

SHA1
09fbd6d1f7f58d5e1d46d296dec9cd81285fe670

SHA256
48b45fcb5886957907400c9c1d3151d12edee005b72992d9c88ef26086aedcce

SHA512
fc4314892ffb2476c9f10afa1a43cc410587c2b31a3940ddfd35066092bd1e433c49d5d8b9817fd367175ca67b554ce1be0dbcd8dc182d67769f46681af4e33f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State

Filesize
903B

MD5
526a1a708a0b75e8f34c613fb8ea0e4d

SHA1
98449379eb9ecffdd234ce64a1b443e52a6c0771

SHA256
ec40dec494dc8a53a6962745203915f5a8c4699b42ec9b7e0ad2d1152d74dfa6

SHA512
e803184b17514649f517f14e21f37d65c03450307840cce0b5f76088b52d5098e139b148871785389d3da6ec1c33df2989e2c0e996549913a54e1fc913354ed6

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe5906cc.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
850B

MD5
9d1ae8af54c9f2df32aead28af458efa

SHA1
ea5a1bbbf5f1f7c80a0e62dbc0d7d91f5dd03ddf

SHA256
f82bce635037196459bdd901a4178ab18077b33dac464ddc0cd12a86e12967e9

SHA512
7e430d836a34bfe71658038827c7c9862c6ac2d1e3a1b699d90f46c96d44aab57eac25648357d8d6dc324f0e3accad0d9e661be63f858f522634f5dfb941c95f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
738B

MD5
a075a775b889a0dc12cf4bdced964e30

SHA1
455efa543eedee9a30b85b814bdcc48137b6a070

SHA256
beb3dd57df48a5f5c8f3628c9ecc12951bf1c7916ca8e9b59007fd97c0a8e6f4

SHA512
f221fc0fa2e18d143ea5d0984f2d64b8dcc75601c93a9dd1420545c20fb755cc6b60d02eea9fa0dcc336d81b9409414bd00e6cd5ae86732e8d398c483a588823

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe583e3d.TMP

Filesize
529B

MD5
b392a6f9212d6e6602cbff826ed2cd69

SHA1
8808570d79a1495f977a81b538b67d1303713e6f

SHA256
a89d36f657b67d457ade1c5416d032175be981eea2d598f06cb4dcd7ed10357d

SHA512
993d28e442d5897d3e950db508ecea0f7e9b1871504fa310f986844a02da6254fcdd63583cbba22321134f44ab7b2703fa4fdd16a250566614e2426bd1fd9703

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
a2bbd6b91125c6586e30bb0d25599d32

SHA1
5b02e654bc2117206f166c1ad91f63343b303c2f

SHA256
5a31392a08572fbb8583679461c1294739502bad4d01c1fc87f8133e9ef5b5b6

SHA512
d2b3920aad4b8b54746941318e616857f17f5a62b0cd7cc7d9acf9f8495ca51e2298e3f825b90d44396f6bdbcad2458774eaaa7c135b90d789797fa1209dbad8

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
3.5MB

MD5
5c287b41538166fc2e012916fe49a6a2

SHA1
98b56ee955e15f5d5e619ed4fe47c7dbb2769a9d

SHA256
2bda601b183fe79a4e8f0d7aaf8f19089978f4626660f984a2a43298e1ee559b

SHA512
eb82b4e9d835d704e320f07420dbfe4132ba8848c31f6623fd0cb803f13885ad5ecd741b2d21a41b1a624758130276e1704cb8f8e6c1ab7fd0b85d21916eaa34

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
25.9MB

MD5
edec040f785bfab1f6732fe2de712718

SHA1
1bb0d8471784604ca8c799359f35cbefa5e42ccc

SHA256
ca90c951d8e36038b610b8b25bac14a34926c9b7d37f86475fc9228ac9df0783

SHA512
5f90e545104a56353cf12b06adbb2b323df3fea08dea0cb2624c06d3ea06149a303a5e1f3babf680757ecc8b72df74b2d8e3a4d09fbe3adafec9cc8ca1a85991

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
667KB

MD5
6c66dfb43b302bb2f59bdb0941fee3f0

SHA1
d150584a60b362d292d52b52b0ce0e81d3835d3b

SHA256
adebb2921cc84e02bbf9417a16ebe18d84938fd27475b517b36a0da9da505ac1

SHA512
f07b6c9008e4dc0e8aaa6b95a4d2b1a1fb437a8d646a973fc7b98f7bfac42df7a50bd83767daf9959976e720eb7dc9eb256838e1dda36c1700de9f1aea07390b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
744ecf3e5f1b18e950533e0d42e6d4ad

SHA1
bb9a9ee40649a3f5bd2e7f46e16c7e5e139b7e54

SHA256
a3cf8aa391aad9d995670099cda3ec390956cd6eb97ac90ecd1d259ba466486e

SHA512
189bfe2a3e5e5a2fdc46128745244c68a7a86fa9bc3af48753e9efdbc229ec3b01c800ee285713656ee93e51a9c4a0a13bf52bdbf818994624929938661d5323

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.0MB

MD5
116acf0f993a8271373391bb763f19ba

SHA1
93a7bf1aa77d916972fc5c23c323b46654c7e65a

SHA256
7ea6cb5e40c9508e145b3b7c739f15484338c265e60b326edd83b862c0a88491

SHA512
acbcaab8fdc43d90b301f70238ea68f0addc6db655bc17c599cd460056165e7201245d50c0ae6003f06ceb7ff8ac73fa97fe5ffa3523cf24dc80b57b179a101e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
656B

MD5
424698b0b65b8efe880c3febb4e14f32

SHA1
e2edf49c6b5b7cfebd33b992df1551b6da931653

SHA256
b4e1deee4d7280b407ac62946f7ec1c507b2a2973f8e026abe11ac42aada6081

SHA512
aacbd0d29d245a8642d0509c7c1a0f79d082ff4fda6d5d5fe8af00962ab9f379dd90f70550d7eec779e99ff375eda619864f9432a922c2a574803639d84b181d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
3eedffdaccc28792e9cb54e7893593b1

SHA1
debb688697fb5f5373def12b962b006bb3451604

SHA256
56867866761b90fd51bb4beb5f7dff1214209b3d02ef727933eebd0ae9cb33e0

SHA512
130350057a3f48e063ce29c736649536ea061147eb951a3ada7466581ddd33dc7235a372694a76bf9477010b5271c0db8d7b4781f5114b1ace2d0f538ff790b5

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
372KB

MD5
8ec756a6dc8db525273420f66b30f87a

SHA1
532e86643b78c421294c2de9e7f64e310f7dd7b0

SHA256
0c7829da1ea0356801a696ff58f9376b7ab0a51c7e5d72758dd0735b7650cf58

SHA512
1eed7644b0cadd888baadb7df0cebe882093d3403fe1939d594df8167e065450a94b0827cc742148056e1e55a9ea0bc0293af1c52a6677588092cad471b46135

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
6.7MB

MD5
c8e6e8471335e821cc0163f76843152e

SHA1
4786a2f9c0f49c6087b7a307208e595f53bad7ae

SHA256
2ada5acc731db75ba7195d28a788484c649abe4ff3874d51235464e87a4dbc24

SHA512
ead4158bad283a8084fd7f11e40b108a46091e2bfc70c6425d95a7cbe1244de97e2610f9494e930b31304ba7d2d35fd6ce06e27807135590ec0bbf14f4137314

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
459KB

MD5
d74fa66466d377a2e5ea85c7142895d6

SHA1
4976fa62b0fc60a92c4a84d7e4b1ab939ed7bfbb

SHA256
dd2c824c1b8365c730fb91ae90f90d0e1115f444d36fd90097b2544e24822205

SHA512
7010936923a8414ebff0197b647a387729f86e6e0fd5166726fed0c9410fcb7644fd3632aa4fe492428efff2e451119fc86e0f85df8a0a93ef071db1800df623

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
2cfe980c0024751358360372fe4bc2b1

SHA1
4d926cf61c0e9d27ff847fc3446f049dbd1da192

SHA256
3905cd0af0025adc86548e2f47d68461408a2e2800d66669c9fdf7829c53dee1

SHA512
8bc0f5ee1ded4c693f0e239fdc308626da2d32cf86997d93e000d8c5bd89e42d77a3e058fe548e6f4aeeb5d1e9391f308071bad6b55212500d9dd7cc1bacc6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.1MB

MD5
5d169d0b80ebd3c7d3fc517d9e13f007

SHA1
ab43a52fbbb3994f4c3a90688b14592353701f9b

SHA256
8aa4a2089231bd8262e988b10d2cb0428a38fa3c6c28f90d00c4437e83cc6d3e

SHA512
e39e0616ea3b904b2f0c512eb5c551aebe407a95baecaa73fa484211c347f128506c305986b26634d4fe3b4339f05251594a8ae2b167f65378aa7674edb5fab8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
646KB

MD5
c88eaf4b5425931be67e9990bbde9974

SHA1
64baa73d939eddb56b190428e7101d600ff5f414

SHA256
d0a5149aa01ae1f1498b4b9a1f76fb7818501e87b64df79ca96a7a2b0ca36ecd

SHA512
a2c40a7f127f45af62d526fcc3a123e5b5356bd2728ed4e1c3fe238bad27be453ef53659d18e21ae678437f7516a0f91e5d44e38e00403384f9e06da01f1248c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.4MB

MD5
d53470239321b69f93ab616564c21ac6

SHA1
e0a75df46a6bf6e5ccb1009d80dc20b11b0312d1

SHA256
c80d43bad94c92b694e8b2b8cf833b674d78ed3f5094e1dcf5434b732ca1338a

SHA512
6507fb604b841b2e8d42a0b99507b9c241dcbc5562870ac6a1877c85b1bd47ab7cb01d0bebb4c93a11cd6b4bf3756f851354cc2feb506b8f99ee36017641ff64

Download Submit
memory/2800-368-0x00000000009A0000-0x00000000023AE000-memory.dmp

Filesize
26.1MB

Download
memory/2800-207-0x00000000009A0000-0x00000000023AE000-memory.dmp

Filesize
26.1MB

Download
memory/3040-378-0x00000000009A0000-0x00000000023AE000-memory.dmp

Filesize
26.1MB

Download
memory/3040-226-0x00000000009A0000-0x00000000023AE000-memory.dmp

Filesize
26.1MB

Download
memory/3388-379-0x00000000009A0000-0x00000000023AE000-memory.dmp

Filesize
26.1MB

Download
memory/3388-265-0x00000000009A0000-0x00000000023AE000-memory.dmp

Filesize
26.1MB

Download
memory/4368-444-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download
memory/4368-445-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download
memory/4368-443-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download
memory/4368-449-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download
memory/4368-455-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download
memory/4368-454-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download
memory/4368-453-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download
memory/4368-452-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download
memory/4368-451-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download
memory/4368-450-0x0000000008C70000-0x0000000008C71000-memory.dmp

Filesize
4KB

Download