f56a1f2ddcc44699d397d3700482cbca85ad8104603fd8e0133f79fca5efd3bf

Resubmissions

06/08/2024, 01:04

240806-be2e1ayaqe 6

06/08/2024, 00:50

240806-a7a8vaxgkd 8

06/08/2024, 00:48

240806-a5tbmstfnk 6

06/08/2024, 00:42

240806-a2lgmatenn 6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpotifySetup.exe
Size

909KB
MD5

6d2f652dfe8001c0caf6aa246a418124
SHA1

d1d5f533b5b514d7d863541974367e3ed86f8bfc
SHA256

f56a1f2ddcc44699d397d3700482cbca85ad8104603fd8e0133f79fca5efd3bf
SHA512

9a8faae6e532702ab0b79863ff1bf490ef8a3e8d5052c2082a2d1426cef171de22ebb895ffb6b6b2173940bbfa89b4c4702966318acc6c5d5e53cd72aa67b39f
SSDEEP

12288:O8PTZuEHn+AgZZpi7xTICP4AC0laDi6u5DUCuUhO:O8PTwEwZpi7xT3/lauB5DUys

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3700_803827579\LICENSE	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3700_803827579\manifest.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3700_803827579\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3700_803827579\manifest.fingerprint	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3700_803827579\_platform_specific\win_x86\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3700_803827579\_platform_specific\win_x86\widevinecdm.dll	Spotify.exe

Executes dropped EXE 9 IoCs

pid	Process
4256	SpWebInst0.exe
3700	Spotify.exe
3416	Spotify.exe
4280	Spotify.exe
2292	Spotify.exe
4128	Spotify.exe
4472	Spotify.exe
3532	Spotify.exe
768	Spotify.exe

Loads dropped DLL 21 IoCs

pid	Process
3700	Spotify.exe
3700	Spotify.exe
3416	Spotify.exe
3416	Spotify.exe
4280	Spotify.exe
4280	Spotify.exe
4280	Spotify.exe
4280	Spotify.exe
4280	Spotify.exe
4280	Spotify.exe
2292	Spotify.exe
2292	Spotify.exe
4128	Spotify.exe
4128	Spotify.exe
4472	Spotify.exe
4472	Spotify.exe
3532	Spotify.exe
3532	Spotify.exe
768	Spotify.exe
768	Spotify.exe
768	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpWebInst0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpotifySetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell	Spotify.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
768	Spotify.exe
768	Spotify.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3700	Spotify.exe
3700	Spotify.exe
3700	Spotify.exe
3700	Spotify.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3700	Spotify.exe
3700	Spotify.exe
3700	Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 4256	3536	SpotifySetup.exe	86
PID 3536 wrote to memory of 4256	3536	SpotifySetup.exe	86
PID 3536 wrote to memory of 4256	3536	SpotifySetup.exe	86
PID 4256 wrote to memory of 3700	4256	SpWebInst0.exe	87
PID 4256 wrote to memory of 3700	4256	SpWebInst0.exe	87
PID 4256 wrote to memory of 3700	4256	SpWebInst0.exe	87
PID 3700 wrote to memory of 3416	3700	Spotify.exe	88
PID 3700 wrote to memory of 3416	3700	Spotify.exe	88
PID 3700 wrote to memory of 3416	3700	Spotify.exe	88
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 4280	3700	Spotify.exe	90
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92
PID 3700 wrote to memory of 2292	3700	Spotify.exe	92

C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe
"C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Adds Run key to start application
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.43.420 --initial-client-data=0x40c,0x410,0x414,0x408,0x418,0x73b4eb74,0x73b4eb80,0x73b4eb8c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3416
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,17783445706237063551,641111413888497493,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4280
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3364,i,17783445706237063551,641111413888497493,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2292
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3484,i,17783445706237063551,641111413888497493,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4128
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3920,i,17783445706237063551,641111413888497493,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4472
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=4736,i,17783445706237063551,641111413888497493,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3532
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2220,i,17783445706237063551,641111413888497493,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3700_803827579\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping3700_803827579\manifest.json

Filesize
984B

MD5
0359d5b66d73a97ce5dc9f89ed84c458

SHA1
ce17e52eaac909dd63d16d93410de675d3e6ec0d

SHA256
beeab2f8d3833839399dde15ce9085c17b304445577d21333e883d6db6d0b755

SHA512
8fd94a098a4ab5c0fcd48c2cef2bb03328dd4d25c899bf5ed1ca561347d74a8aab8a214ba2d3180a86df72c52eb26987a44631d0ecd9edc84976c28d6c9dc16a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
5a723a8b6c021a74a909c980f2a73346

SHA1
df491a904f5b5347b92461a2730d734cc53a02d0

SHA256
8a0843710e2b9ba814a70d8ab0512b68de50eb4065b34f94703ec56ab38c7bd7

SHA512
bf69abac5065f45756c08253397a52cd6dd8aea2c8258d0f37361f183b085d87866fb5346c3be2d710f7ee29cb509781450aa11f7e170cb5bfb4d580bdf27d14

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
8a939dbcb64b15ca406663d75d1049e9

SHA1
57a50672fb34f52fc7ff67a4758a8885f0aa9f26

SHA256
08189a47c69d5d3b30cc7f009690544348ee4e01dcdfc3d932965d482d3fc6fb

SHA512
37e330787daee2cc007593317e5e6cb8e9ed718d7be47a73f4f9e655dea85797ed4a9cf2eec092dbaa8ee24e04f46c5beae5607ff2d52bb61e05c3557d6f0d4e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\1d1429ee-4418-4736-aa08-c5393f07610c.tmp

Filesize
904B

MD5
38314a8782c7d0044962e8f1471c5891

SHA1
9a6b7ce2af46eaa992945d7e86f9ef8f8c0bdaa5

SHA256
134d9839e1baf1f9e7ad8bc76876dcc2af1dbc07afaabca0a664015bbf15a9a1

SHA512
e39923abf2a2cd6d2703a20d39c285540fe90fda671eab21b5c2097d5fb64cb3608d3c01679c84f176cf98e1c8a4125e4ffeff2e65becb4524e8aaed3a1ce014

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe58fc2e.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
850B

MD5
46c6d38935b41c239f0e75b5e1722c61

SHA1
ea6f9dcd872a67eee67b2a6b535c399db8c55f84

SHA256
b1218665c9853c22fff407187f8d303affd424f6bb41e906bf67f405aa7e95fc

SHA512
979e892fec28f68b070a2cb8cb4527f828748b43e5a2eb761fb89de1c797285a6e0395f6282bcdf03a16aef2f6fae92e154363c24410bfdcc690deb036f4cc1a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
738B

MD5
e505c5f69827910a6dda545f0806c31a

SHA1
84d1a94e3de75259f98aba6a8857a2f7b07f3a2d

SHA256
149bc3845ded5c5245fbec4dc7b3e2b2355d51e31c915d049c0fd971ec95d837

SHA512
c8f03831e7a2fe4e384fef48b78ed539583f6e67a697b6a4567233c4448cfcb678918c701c2f068f5edbe36b9e09a84598c779db5f03ce21a9440877164aa7f4

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe583256.TMP

Filesize
529B

MD5
f6d4d3e93982890825a927fdb0684954

SHA1
39f9446ccaa3965274044ba38a0bf73c3aaaf2f3

SHA256
ba6599537013ac47ab92aef27320fda5b0724ce831990f031ec66d0c68ba56ac

SHA512
848d787cb6923f21c0bb5c7c3a6edd5820dd336c67355e459c7772de06fa5821ebf8e4a30806ad1960b2d9fae51005e151336b6931a62effa5c823a1a1a73a78

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
b2d4140a0f82c67a201c4804f3a14bf8

SHA1
e5d214e32eedb2b751811b585a279d8e6be2d756

SHA256
7958374e847fcdf206b57c86b3b55ac4076004d801740d95c88a8da0fd66b30d

SHA512
af35ec3b0f7fe9b7a1d54ffc794a4d78fc70f695839769e2d95fa26c955913ea6ad1248034754c2492340f7ae27cdb946aae8702f9258d936d4c3ef1cc0beb0e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
3.5MB

MD5
5c287b41538166fc2e012916fe49a6a2

SHA1
98b56ee955e15f5d5e619ed4fe47c7dbb2769a9d

SHA256
2bda601b183fe79a4e8f0d7aaf8f19089978f4626660f984a2a43298e1ee559b

SHA512
eb82b4e9d835d704e320f07420dbfe4132ba8848c31f6623fd0cb803f13885ad5ecd741b2d21a41b1a624758130276e1704cb8f8e6c1ab7fd0b85d21916eaa34

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
25.9MB

MD5
edec040f785bfab1f6732fe2de712718

SHA1
1bb0d8471784604ca8c799359f35cbefa5e42ccc

SHA256
ca90c951d8e36038b610b8b25bac14a34926c9b7d37f86475fc9228ac9df0783

SHA512
5f90e545104a56353cf12b06adbb2b323df3fea08dea0cb2624c06d3ea06149a303a5e1f3babf680757ecc8b72df74b2d8e3a4d09fbe3adafec9cc8ca1a85991

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
667KB

MD5
6c66dfb43b302bb2f59bdb0941fee3f0

SHA1
d150584a60b362d292d52b52b0ce0e81d3835d3b

SHA256
adebb2921cc84e02bbf9417a16ebe18d84938fd27475b517b36a0da9da505ac1

SHA512
f07b6c9008e4dc0e8aaa6b95a4d2b1a1fb437a8d646a973fc7b98f7bfac42df7a50bd83767daf9959976e720eb7dc9eb256838e1dda36c1700de9f1aea07390b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
744ecf3e5f1b18e950533e0d42e6d4ad

SHA1
bb9a9ee40649a3f5bd2e7f46e16c7e5e139b7e54

SHA256
a3cf8aa391aad9d995670099cda3ec390956cd6eb97ac90ecd1d259ba466486e

SHA512
189bfe2a3e5e5a2fdc46128745244c68a7a86fa9bc3af48753e9efdbc229ec3b01c800ee285713656ee93e51a9c4a0a13bf52bdbf818994624929938661d5323

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.0MB

MD5
116acf0f993a8271373391bb763f19ba

SHA1
93a7bf1aa77d916972fc5c23c323b46654c7e65a

SHA256
7ea6cb5e40c9508e145b3b7c739f15484338c265e60b326edd83b862c0a88491

SHA512
acbcaab8fdc43d90b301f70238ea68f0addc6db655bc17c599cd460056165e7201245d50c0ae6003f06ceb7ff8ac73fa97fe5ffa3523cf24dc80b57b179a101e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
656B

MD5
424698b0b65b8efe880c3febb4e14f32

SHA1
e2edf49c6b5b7cfebd33b992df1551b6da931653

SHA256
b4e1deee4d7280b407ac62946f7ec1c507b2a2973f8e026abe11ac42aada6081

SHA512
aacbd0d29d245a8642d0509c7c1a0f79d082ff4fda6d5d5fe8af00962ab9f379dd90f70550d7eec779e99ff375eda619864f9432a922c2a574803639d84b181d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
3eedffdaccc28792e9cb54e7893593b1

SHA1
debb688697fb5f5373def12b962b006bb3451604

SHA256
56867866761b90fd51bb4beb5f7dff1214209b3d02ef727933eebd0ae9cb33e0

SHA512
130350057a3f48e063ce29c736649536ea061147eb951a3ada7466581ddd33dc7235a372694a76bf9477010b5271c0db8d7b4781f5114b1ace2d0f538ff790b5

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
372KB

MD5
8ec756a6dc8db525273420f66b30f87a

SHA1
532e86643b78c421294c2de9e7f64e310f7dd7b0

SHA256
0c7829da1ea0356801a696ff58f9376b7ab0a51c7e5d72758dd0735b7650cf58

SHA512
1eed7644b0cadd888baadb7df0cebe882093d3403fe1939d594df8167e065450a94b0827cc742148056e1e55a9ea0bc0293af1c52a6677588092cad471b46135

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
6.7MB

MD5
c8e6e8471335e821cc0163f76843152e

SHA1
4786a2f9c0f49c6087b7a307208e595f53bad7ae

SHA256
2ada5acc731db75ba7195d28a788484c649abe4ff3874d51235464e87a4dbc24

SHA512
ead4158bad283a8084fd7f11e40b108a46091e2bfc70c6425d95a7cbe1244de97e2610f9494e930b31304ba7d2d35fd6ce06e27807135590ec0bbf14f4137314

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
459KB

MD5
d74fa66466d377a2e5ea85c7142895d6

SHA1
4976fa62b0fc60a92c4a84d7e4b1ab939ed7bfbb

SHA256
dd2c824c1b8365c730fb91ae90f90d0e1115f444d36fd90097b2544e24822205

SHA512
7010936923a8414ebff0197b647a387729f86e6e0fd5166726fed0c9410fcb7644fd3632aa4fe492428efff2e451119fc86e0f85df8a0a93ef071db1800df623

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
2cfe980c0024751358360372fe4bc2b1

SHA1
4d926cf61c0e9d27ff847fc3446f049dbd1da192

SHA256
3905cd0af0025adc86548e2f47d68461408a2e2800d66669c9fdf7829c53dee1

SHA512
8bc0f5ee1ded4c693f0e239fdc308626da2d32cf86997d93e000d8c5bd89e42d77a3e058fe548e6f4aeeb5d1e9391f308071bad6b55212500d9dd7cc1bacc6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.1MB

MD5
5d169d0b80ebd3c7d3fc517d9e13f007

SHA1
ab43a52fbbb3994f4c3a90688b14592353701f9b

SHA256
8aa4a2089231bd8262e988b10d2cb0428a38fa3c6c28f90d00c4437e83cc6d3e

SHA512
e39e0616ea3b904b2f0c512eb5c551aebe407a95baecaa73fa484211c347f128506c305986b26634d4fe3b4339f05251594a8ae2b167f65378aa7674edb5fab8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
646KB

MD5
c88eaf4b5425931be67e9990bbde9974

SHA1
64baa73d939eddb56b190428e7101d600ff5f414

SHA256
d0a5149aa01ae1f1498b4b9a1f76fb7818501e87b64df79ca96a7a2b0ca36ecd

SHA512
a2c40a7f127f45af62d526fcc3a123e5b5356bd2728ed4e1c3fe238bad27be453ef53659d18e21ae678437f7516a0f91e5d44e38e00403384f9e06da01f1248c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.4MB

MD5
d53470239321b69f93ab616564c21ac6

SHA1
e0a75df46a6bf6e5ccb1009d80dc20b11b0312d1

SHA256
c80d43bad94c92b694e8b2b8cf833b674d78ed3f5094e1dcf5434b732ca1338a

SHA512
6507fb604b841b2e8d42a0b99507b9c241dcbc5562870ac6a1877c85b1bd47ab7cb01d0bebb4c93a11cd6b4bf3756f851354cc2feb506b8f99ee36017641ff64

Download Submit
memory/768-443-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/768-451-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/768-447-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/768-448-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/768-449-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/768-450-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/768-442-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/768-441-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/768-453-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/768-452-0x00000000087C0000-0x00000000087C1000-memory.dmp

Filesize
4KB

Download
memory/3416-226-0x00000000004B0000-0x0000000001EBE000-memory.dmp

Filesize
26.1MB

Download
memory/3700-208-0x00000000004B0000-0x0000000001EBE000-memory.dmp

Filesize
26.1MB

Download
memory/3700-368-0x00000000004B0000-0x0000000001EBE000-memory.dmp

Filesize
26.1MB

Download
memory/4280-378-0x00000000004B0000-0x0000000001EBE000-memory.dmp

Filesize
26.1MB

Download
memory/4280-265-0x00000000004B0000-0x0000000001EBE000-memory.dmp

Filesize
26.1MB

Download