f56a1f2ddcc44699d397d3700482cbca85ad8104603fd8e0133f79fca5efd3bf

Resubmissions

06/08/2024, 01:04

240806-be2e1ayaqe 6

06/08/2024, 00:50

240806-a7a8vaxgkd 8

06/08/2024, 00:48

240806-a5tbmstfnk 6

06/08/2024, 00:42

240806-a2lgmatenn 6

Analysis

max time kernel
1800s
max time network
1157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpotifySetup.exe
Size

909KB
MD5

6d2f652dfe8001c0caf6aa246a418124
SHA1

d1d5f533b5b514d7d863541974367e3ed86f8bfc
SHA256

f56a1f2ddcc44699d397d3700482cbca85ad8104603fd8e0133f79fca5efd3bf
SHA512

9a8faae6e532702ab0b79863ff1bf490ef8a3e8d5052c2082a2d1426cef171de22ebb895ffb6b6b2173940bbfa89b4c4702966318acc6c5d5e53cd72aa67b39f
SSDEEP

12288:O8PTZuEHn+AgZZpi7xTICP4AC0laDi6u5DUCuUhO:O8PTwEwZpi7xT3/lauB5DUys

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4364_337112591\_platform_specific\win_x86\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4364_337112591\_platform_specific\win_x86\widevinecdm.dll	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4364_337112591\LICENSE	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4364_337112591\manifest.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4364_337112591\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4364_337112591\manifest.fingerprint	Spotify.exe

Executes dropped EXE 9 IoCs

pid	Process
1480	SpWebInst0.exe
4364	Spotify.exe
796	Spotify.exe
4488	Spotify.exe
1080	Spotify.exe
2720	Spotify.exe
1644	Spotify.exe
4916	Spotify.exe
4780	Spotify.exe

Loads dropped DLL 21 IoCs

pid	Process
4364	Spotify.exe
4364	Spotify.exe
796	Spotify.exe
796	Spotify.exe
4488	Spotify.exe
4488	Spotify.exe
4488	Spotify.exe
4488	Spotify.exe
4488	Spotify.exe
4488	Spotify.exe
2720	Spotify.exe
2720	Spotify.exe
1080	Spotify.exe
1080	Spotify.exe
1644	Spotify.exe
1644	Spotify.exe
4916	Spotify.exe
4916	Spotify.exe
4780	Spotify.exe
4780	Spotify.exe
4780	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpotifySetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpWebInst0.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4780	Spotify.exe
4780	Spotify.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe
Token: SeShutdownPrivilege	4364	Spotify.exe
Token: SeCreatePagefilePrivilege	4364	Spotify.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4364	Spotify.exe
4364	Spotify.exe
4364	Spotify.exe
4364	Spotify.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4364	Spotify.exe
4364	Spotify.exe
4364	Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1480	1320	SpotifySetup.exe	87
PID 1320 wrote to memory of 1480	1320	SpotifySetup.exe	87
PID 1320 wrote to memory of 1480	1320	SpotifySetup.exe	87
PID 1480 wrote to memory of 4364	1480	SpWebInst0.exe	88
PID 1480 wrote to memory of 4364	1480	SpWebInst0.exe	88
PID 1480 wrote to memory of 4364	1480	SpWebInst0.exe	88
PID 4364 wrote to memory of 796	4364	Spotify.exe	89
PID 4364 wrote to memory of 796	4364	Spotify.exe	89
PID 4364 wrote to memory of 796	4364	Spotify.exe	89
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 4488	4364	Spotify.exe	91
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94
PID 4364 wrote to memory of 1080	4364	Spotify.exe	94

C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe
"C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Adds Run key to start application
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.43.420 --initial-client-data=0x40c,0x410,0x414,0x408,0x418,0x734deb74,0x734deb80,0x734deb8c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:796
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,17062707251833430260,3003482002253781565,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4488
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3380,i,17062707251833430260,3003482002253781565,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1080
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3512,i,17062707251833430260,3003482002253781565,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2720
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4000,i,17062707251833430260,3003482002253781565,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1644
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3100,i,17062707251833430260,3003482002253781565,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4916
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1028,i,17062707251833430260,3003482002253781565,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=832 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4364_337112591\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files (x86)\chrome_Unpacker_BeginUnzipping4364_337112591\manifest.json

Filesize
984B

MD5
0359d5b66d73a97ce5dc9f89ed84c458

SHA1
ce17e52eaac909dd63d16d93410de675d3e6ec0d

SHA256
beeab2f8d3833839399dde15ce9085c17b304445577d21333e883d6db6d0b755

SHA512
8fd94a098a4ab5c0fcd48c2cef2bb03328dd4d25c899bf5ed1ca561347d74a8aab8a214ba2d3180a86df72c52eb26987a44631d0ecd9edc84976c28d6c9dc16a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
b849616740939280b390f182bb92a78a

SHA1
47648b45928cc05555e7d2bcb926d773b29ec3f1

SHA256
785310a41c32995392355bd7c336eda0da1b048d1d952a24a21a4643239a3c5b

SHA512
6fae97611c1f46244e1fa65f970350d2182eacfbce7f6d541c68771f85c500c2cccd8dc75be307700ad66a0766212eb162da9c6d18c318b130bf0f30c912d13f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
77d6b6e026b99948a4959a9f3539e72d

SHA1
181a6a4d10efc519f044888b36eac75ec1891aa5

SHA256
b1c6685588e935adc024428a8f7c5cc53632aba6e5afb2a20cc8f2a1a91660a6

SHA512
d3e608db885f3bfcdb298011474ed8537dfea3c5e570480bf60040c667ad721bccbc92cd31ca5ce7ef72100ca5724916d803d2f5d484b3fd0cf5d3fe652bbc70

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State

Filesize
904B

MD5
b3123afefa390b9f28d4c6033a66b2bb

SHA1
b25349311f601ab0d9a4bbc61fc67c20f4a1b4ca

SHA256
c9a82b4cc3beb13806653bcae1cb292dbbab981e43311c8cba4aa3a5cb91ff5e

SHA512
1dffb8114cb01bd9197330b467aa51303ff57d88172c3ef7fa73bf7ce8d5c4f6271b7a1a3166898ce9ce55804ce31f4676bdb26997c7cd745512213ab4fabffc

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe58f71d.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
738B

MD5
def2dc716d2689c46248ee791c8244f9

SHA1
17a52edb0bb06e8a125e7aa56c67332366acbe81

SHA256
8b7e258f848e942f33c33008ba3d4771faf1f54580f3ce628b9de538e01730d5

SHA512
11845a94b52b3cf354f680b6ff79e829e8fdbb0b49e0322b6a3146a758da0175de4661babecfb35f076a43cd08b229a5f01e656c7b72412acc2a14540730a669

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
850B

MD5
149aaa7d7d01c967a39c96bd254b1c13

SHA1
102cb8b21f455a4d2348a42821ba7ad7f5a3d75b

SHA256
20e011bd3882e0fb390c0181529975595bb7bde67d52a11f51292bf6e172aff4

SHA512
c7006dd4eed029df3a22b92932e2c7d4294f79bcc96ce216b49b2d4035dcb461af8cb6e475d6a20a3b2e4bfa2b81072d7a5b2362a9cfe16230e9ddfc3d0cfdd9

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe582d45.TMP

Filesize
529B

MD5
46d252da456b24bc50ebcc24b5ce38e6

SHA1
55fe656994050c85b0d71ac0963c597fd2b74c07

SHA256
4e90aec0e18d301fb27f712624f83b28ccb278712391a47b1df390ff182b592f

SHA512
bc1a4d2b876a0c67d5e616dbc5cf6b38d029f8273e88b6bc302be279119d3175a2264d1d4bb4037156ef37c9720965344b1cd7060b23e3862db6a35e96a38a46

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
1c857d88c5985a9ded7ef6d6084a588b

SHA1
30ea03bba3243c1a51a830b56dc4fcbfdbaf6959

SHA256
a22afdae65db8b6c8b1788329f5834fe46b70b6a2918570e964b20a4b4fb3990

SHA512
ae2400296c214e01b727063673b11991a1039e67c55e694ae092b9e9a5ae89d15fd16462bfe0375a84903ce61286fe6b8d69375d9f4082afccc7b90e82828c91

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
3.5MB

MD5
5c287b41538166fc2e012916fe49a6a2

SHA1
98b56ee955e15f5d5e619ed4fe47c7dbb2769a9d

SHA256
2bda601b183fe79a4e8f0d7aaf8f19089978f4626660f984a2a43298e1ee559b

SHA512
eb82b4e9d835d704e320f07420dbfe4132ba8848c31f6623fd0cb803f13885ad5ecd741b2d21a41b1a624758130276e1704cb8f8e6c1ab7fd0b85d21916eaa34

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll

Filesize
3.9MB

MD5
3eedffdaccc28792e9cb54e7893593b1

SHA1
debb688697fb5f5373def12b962b006bb3451604

SHA256
56867866761b90fd51bb4beb5f7dff1214209b3d02ef727933eebd0ae9cb33e0

SHA512
130350057a3f48e063ce29c736649536ea061147eb951a3ada7466581ddd33dc7235a372694a76bf9477010b5271c0db8d7b4781f5114b1ace2d0f538ff790b5

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
25.9MB

MD5
edec040f785bfab1f6732fe2de712718

SHA1
1bb0d8471784604ca8c799359f35cbefa5e42ccc

SHA256
ca90c951d8e36038b610b8b25bac14a34926c9b7d37f86475fc9228ac9df0783

SHA512
5f90e545104a56353cf12b06adbb2b323df3fea08dea0cb2624c06d3ea06149a303a5e1f3babf680757ecc8b72df74b2d8e3a4d09fbe3adafec9cc8ca1a85991

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
667KB

MD5
6c66dfb43b302bb2f59bdb0941fee3f0

SHA1
d150584a60b362d292d52b52b0ce0e81d3835d3b

SHA256
adebb2921cc84e02bbf9417a16ebe18d84938fd27475b517b36a0da9da505ac1

SHA512
f07b6c9008e4dc0e8aaa6b95a4d2b1a1fb437a8d646a973fc7b98f7bfac42df7a50bd83767daf9959976e720eb7dc9eb256838e1dda36c1700de9f1aea07390b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
744ecf3e5f1b18e950533e0d42e6d4ad

SHA1
bb9a9ee40649a3f5bd2e7f46e16c7e5e139b7e54

SHA256
a3cf8aa391aad9d995670099cda3ec390956cd6eb97ac90ecd1d259ba466486e

SHA512
189bfe2a3e5e5a2fdc46128745244c68a7a86fa9bc3af48753e9efdbc229ec3b01c800ee285713656ee93e51a9c4a0a13bf52bdbf818994624929938661d5323

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.0MB

MD5
116acf0f993a8271373391bb763f19ba

SHA1
93a7bf1aa77d916972fc5c23c323b46654c7e65a

SHA256
7ea6cb5e40c9508e145b3b7c739f15484338c265e60b326edd83b862c0a88491

SHA512
acbcaab8fdc43d90b301f70238ea68f0addc6db655bc17c599cd460056165e7201245d50c0ae6003f06ceb7ff8ac73fa97fe5ffa3523cf24dc80b57b179a101e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
656B

MD5
424698b0b65b8efe880c3febb4e14f32

SHA1
e2edf49c6b5b7cfebd33b992df1551b6da931653

SHA256
b4e1deee4d7280b407ac62946f7ec1c507b2a2973f8e026abe11ac42aada6081

SHA512
aacbd0d29d245a8642d0509c7c1a0f79d082ff4fda6d5d5fe8af00962ab9f379dd90f70550d7eec779e99ff375eda619864f9432a922c2a574803639d84b181d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
372KB

MD5
8ec756a6dc8db525273420f66b30f87a

SHA1
532e86643b78c421294c2de9e7f64e310f7dd7b0

SHA256
0c7829da1ea0356801a696ff58f9376b7ab0a51c7e5d72758dd0735b7650cf58

SHA512
1eed7644b0cadd888baadb7df0cebe882093d3403fe1939d594df8167e065450a94b0827cc742148056e1e55a9ea0bc0293af1c52a6677588092cad471b46135

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
6.7MB

MD5
c8e6e8471335e821cc0163f76843152e

SHA1
4786a2f9c0f49c6087b7a307208e595f53bad7ae

SHA256
2ada5acc731db75ba7195d28a788484c649abe4ff3874d51235464e87a4dbc24

SHA512
ead4158bad283a8084fd7f11e40b108a46091e2bfc70c6425d95a7cbe1244de97e2610f9494e930b31304ba7d2d35fd6ce06e27807135590ec0bbf14f4137314

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
459KB

MD5
d74fa66466d377a2e5ea85c7142895d6

SHA1
4976fa62b0fc60a92c4a84d7e4b1ab939ed7bfbb

SHA256
dd2c824c1b8365c730fb91ae90f90d0e1115f444d36fd90097b2544e24822205

SHA512
7010936923a8414ebff0197b647a387729f86e6e0fd5166726fed0c9410fcb7644fd3632aa4fe492428efff2e451119fc86e0f85df8a0a93ef071db1800df623

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
2cfe980c0024751358360372fe4bc2b1

SHA1
4d926cf61c0e9d27ff847fc3446f049dbd1da192

SHA256
3905cd0af0025adc86548e2f47d68461408a2e2800d66669c9fdf7829c53dee1

SHA512
8bc0f5ee1ded4c693f0e239fdc308626da2d32cf86997d93e000d8c5bd89e42d77a3e058fe548e6f4aeeb5d1e9391f308071bad6b55212500d9dd7cc1bacc6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.1MB

MD5
5d169d0b80ebd3c7d3fc517d9e13f007

SHA1
ab43a52fbbb3994f4c3a90688b14592353701f9b

SHA256
8aa4a2089231bd8262e988b10d2cb0428a38fa3c6c28f90d00c4437e83cc6d3e

SHA512
e39e0616ea3b904b2f0c512eb5c551aebe407a95baecaa73fa484211c347f128506c305986b26634d4fe3b4339f05251594a8ae2b167f65378aa7674edb5fab8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
646KB

MD5
c88eaf4b5425931be67e9990bbde9974

SHA1
64baa73d939eddb56b190428e7101d600ff5f414

SHA256
d0a5149aa01ae1f1498b4b9a1f76fb7818501e87b64df79ca96a7a2b0ca36ecd

SHA512
a2c40a7f127f45af62d526fcc3a123e5b5356bd2728ed4e1c3fe238bad27be453ef53659d18e21ae678437f7516a0f91e5d44e38e00403384f9e06da01f1248c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.4MB

MD5
d53470239321b69f93ab616564c21ac6

SHA1
e0a75df46a6bf6e5ccb1009d80dc20b11b0312d1

SHA256
c80d43bad94c92b694e8b2b8cf833b674d78ed3f5094e1dcf5434b732ca1338a

SHA512
6507fb604b841b2e8d42a0b99507b9c241dcbc5562870ac6a1877c85b1bd47ab7cb01d0bebb4c93a11cd6b4bf3756f851354cc2feb506b8f99ee36017641ff64

Download Submit
memory/796-378-0x0000000000BE0000-0x00000000025EE000-memory.dmp

Filesize
26.1MB

Download
memory/796-226-0x0000000000BE0000-0x00000000025EE000-memory.dmp

Filesize
26.1MB

Download
memory/4364-368-0x0000000000BE0000-0x00000000025EE000-memory.dmp

Filesize
26.1MB

Download
memory/4364-208-0x0000000000BE0000-0x00000000025EE000-memory.dmp

Filesize
26.1MB

Download
memory/4488-379-0x0000000000BE0000-0x00000000025EE000-memory.dmp

Filesize
26.1MB

Download
memory/4488-245-0x0000000000BE0000-0x00000000025EE000-memory.dmp

Filesize
26.1MB

Download
memory/4780-444-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/4780-442-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/4780-443-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/4780-454-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/4780-453-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/4780-452-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/4780-451-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/4780-450-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/4780-449-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download
memory/4780-448-0x00000000090F0000-0x00000000090F1000-memory.dmp

Filesize
4KB

Download