a461119f4dcaca45b8438792b6daba9a83d520f47127ebb7a7ed6d68c0ac1008

Analysis

max time kernel
106s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install_New_theme.bat
Size

600B
MD5

99638e3caf39bd8aac3010f291727fcd
SHA1

f688f9f969ffaf78c62f17f8a8df44490b952514
SHA256

a461119f4dcaca45b8438792b6daba9a83d520f47127ebb7a7ed6d68c0ac1008
SHA512

638bdc5e83558daf1c3d14e1ef3669d578ce3bc0df7c4643441e00d1d334397d409bb1329f07d559f0b7de21cfee406abfde24f7bc4d3129f2cf52e53612e84f

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	4400	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 8 IoCs

pid	Process
2836	SpotifySetup.exe
2672	Spotify.exe
1176	Spotify.exe
4616	Spotify.exe
4104	Spotify.exe
4992	Spotify.exe
4692	Spotify.exe
1100	Spotify.exe

Loads dropped DLL 16 IoCs

pid	Process
1176	Spotify.exe
1176	Spotify.exe
4616	Spotify.exe
4616	Spotify.exe
4104	Spotify.exe
4104	Spotify.exe
4104	Spotify.exe
4104	Spotify.exe
4104	Spotify.exe
4104	Spotify.exe
4992	Spotify.exe
4992	Spotify.exe
4692	Spotify.exe
4692	Spotify.exe
1100	Spotify.exe
1100	Spotify.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
8	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4400	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpotifySetup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5336	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5336	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeIncreaseQuotaPrivilege	4400	powershell.exe
Token: SeSecurityPrivilege	4400	powershell.exe
Token: SeTakeOwnershipPrivilege	4400	powershell.exe
Token: SeLoadDriverPrivilege	4400	powershell.exe
Token: SeSystemProfilePrivilege	4400	powershell.exe
Token: SeSystemtimePrivilege	4400	powershell.exe
Token: SeProfSingleProcessPrivilege	4400	powershell.exe
Token: SeIncBasePriorityPrivilege	4400	powershell.exe
Token: SeCreatePagefilePrivilege	4400	powershell.exe
Token: SeBackupPrivilege	4400	powershell.exe
Token: SeRestorePrivilege	4400	powershell.exe
Token: SeShutdownPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeSystemEnvironmentPrivilege	4400	powershell.exe
Token: SeRemoteShutdownPrivilege	4400	powershell.exe
Token: SeUndockPrivilege	4400	powershell.exe
Token: SeManageVolumePrivilege	4400	powershell.exe
Token: 33	4400	powershell.exe
Token: 34	4400	powershell.exe
Token: 35	4400	powershell.exe
Token: 36	4400	powershell.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1176	Spotify.exe
1176	Spotify.exe
1176	Spotify.exe
1176	Spotify.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
1176	Spotify.exe
1176	Spotify.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1176	Spotify.exe
1176	Spotify.exe
1176	Spotify.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
1176	Spotify.exe
1176	Spotify.exe
5336	vlc.exe
5336	vlc.exe
5336	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5336	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4400	3176	cmd.exe	85
PID 3176 wrote to memory of 4400	3176	cmd.exe	85
PID 4400 wrote to memory of 2628	4400	powershell.exe	94
PID 4400 wrote to memory of 2628	4400	powershell.exe	94
PID 4400 wrote to memory of 4432	4400	powershell.exe	95
PID 4400 wrote to memory of 4432	4400	powershell.exe	95
PID 4400 wrote to memory of 3064	4400	powershell.exe	96
PID 4400 wrote to memory of 3064	4400	powershell.exe	96
PID 4400 wrote to memory of 536	4400	powershell.exe	101
PID 4400 wrote to memory of 536	4400	powershell.exe	101
PID 1520 wrote to memory of 2836	1520	explorer.exe	103
PID 1520 wrote to memory of 2836	1520	explorer.exe	103
PID 1520 wrote to memory of 2836	1520	explorer.exe	103
PID 2836 wrote to memory of 2672	2836	SpotifySetup.exe	105
PID 2836 wrote to memory of 2672	2836	SpotifySetup.exe	105
PID 2836 wrote to memory of 2672	2836	SpotifySetup.exe	105
PID 1176 wrote to memory of 4616	1176	Spotify.exe	111
PID 1176 wrote to memory of 4616	1176	Spotify.exe	111
PID 1176 wrote to memory of 4616	1176	Spotify.exe	111
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4104	1176	Spotify.exe	112
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113
PID 1176 wrote to memory of 4992	1176	Spotify.exe	113

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install_New_theme.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-new_theme'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/spotx-official.github.io/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/run.ps1' })} $p """" | iex
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -V
    3⤵
    PID:2628
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -Is -w "%{http_code} \n" -o /dev/null https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.44.405.g81fd6352-5851.exe --retry 2 --ssl-no-revoke
    3⤵
    PID:4432
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -q https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.44.405.g81fd6352-5851.exe -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-08-20_18-02-20\SpotifySetup.exe --progress-bar --retry 3 --ssl-no-revoke
    3⤵
    PID:3064
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-08-20_18-02-20\SpotifySetup.exe
    3⤵
    PID:536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-08-20_18-02-20\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-08-20_18-02-20\SpotifySetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2672

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.44.405 --initial-client-data=0x440,0x444,0x448,0x43c,0x44c,0x6871eb74,0x6871eb80,0x6871eb8c
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4616
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.44.405" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1852,i,14179352316885772536,12276940784120394229,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4104
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.44.405" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3344,i,14179352316885772536,12276940784120394229,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4992
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.44.405" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3476,i,14179352316885772536,12276940784120394229,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4692
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.44.405" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3976,i,14179352316885772536,12276940784120394229,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.spotify.com/login?continue=https%3A%2F%2Faccounts.spotify.com%2Foauth2%2Fv2%2Fauth%3Fclient_id%3D65b708073fc0480ea92a077233ca87bd%26response_type%3Dcode%26redirect_uri%3Dhttp%253A%252F%252F127.0.0.1%253A4381%252Flogin%26scope%3Dapp-remote-control%252Cplaylist-modify%252Cplaylist-modify-private%252Cplaylist-modify-public%252Cplaylist-read%252Cplaylist-read-collaborative%252Cplaylist-read-private%252Cstreaming%252Cugc-image-upload%252Cuser-follow-modify%252Cuser-follow-read%252Cuser-library-modify%252Cuser-library-read%252Cuser-modify%252Cuser-modify-playback-state%252Cuser-modify-private%252Cuser-personalized%252Cuser-read-birthdate%252Cuser-read-currently-playing%252Cuser-read-email%252Cuser-read-play-history%252Cuser-read-playback-position%252Cuser-read-playback-state%252Cuser-read-private%252Cuser-read-recently-played%252Cuser-top-read%26code_challenge%3DVoSilnl6IDCf_ttJYybQIgzdbJnRvG4-pZ-zA9XE72M%26code_challenge_method%3DS256&method=login-accounts&creation_flow=desktop&creation_point=https%3A%2F%2Flogin.app.spotify.com%2F%3Fclient_id%3D65b708073fc0480ea92a077233ca87bd%26utm_source%3Dspotify%26utm_medium%3Ddesktop-win32%26utm_campaign%3Dorganic&flow_ctx=81704cc5-b6dc-4239-96b3-9373cac1f0e1%3A1724198597&utm_source=spotify&utm_medium=desktop-win32&utm_campaign=organic
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffca45446f8,0x7ffca4544708,0x7ffca4544718
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2544 /prefetch:1
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6374473619280974306,2408298464430440014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5412

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\TraceDismount.rmi"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
fa67eab61fadf11892bdf4061c51645d

SHA1
a4ca6309331a04b7c007a3cb5d4530bda059f195

SHA256
702a7f0758564c14ca534083afac637ce7040c349781a922c5b9f93eee046ae1

SHA512
767d2f88ce173638b5e160da1c158e90cc83e6d4c51d46c2759479534aa05b81916596752fc23922abc31c987f35f8b53dba68a530e51696ebdada7152f674ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
254c8230d294320d80a7606bdf99bd87

SHA1
4ebf67f4c39f93f31d3f7261c5f66cf4e5bcf494

SHA256
9f9244b3a3e6f9598ea18121c3c70c99ff5dc36a615165ae7735438ada9bf8b4

SHA512
71ce5ca7d9112ff9e11ca07111d248314d138009ecfb968877ffb13504c00f0f75b4f22231f765497c907c4ade0151e777d5bedae90241faf432832e8a934d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ceb6d15e0c01a58e6556e44fa4cd3419

SHA1
0352642f35608248f919809f44ab816a45b6c19d

SHA256
f8312175efa9ddf9250fa3875f4262efc2be9df275479a2b53b317e4cb72beb5

SHA512
3e92f1def04fb6620844126afd3dce3aade7e5e24bf66786563b61be17b56d5b59fc48a39fc2bf37626af767310ca439748dd3cc6b554379f13b8ac0faee7fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd6b01bc5c3c9a06560915643f611733

SHA1
43a563236d6cbc59f834bf9b04eab893d599a8ba

SHA256
c49e4eddf667c9183b2a18a4cad74ccd74553e39d883091cda2f91364b23edaf

SHA512
0f9fde2433ff84a4488579d04ad7ebb187d40cc03eaddb6a9813a6ba67c20717b24e59d0fd0c55820dcb07463947b61ff0181d317bc472638d1e5d7ffc759eac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5042d48b031580da154db220767943d0

SHA1
da0bd6a36c6a2bcb20a60ebe7276d62862e67be1

SHA256
55ff58a3a409b3c2b2c56d553941c72152b20d03c26728b3b3c62c3df044011f

SHA512
28bb36bf347639e0664a4f765a3d2979c071ded5a2520050814b2aff1ba0ccacf155d6e076b340a56e7240d99eccd936345352179be0aaf21b743fa830e73349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e8a2a4fa5a65d15f2a5f26603623c4e6

SHA1
f911f72d2f5843178276e1e843e1b05244ab1043

SHA256
a57e4dfaa2418d4398d8b8752ff31ec786f3738592dcb2f04af20b389045d56a

SHA512
be85a943ae90f2d5a54b54a725724d8f307bd7a7fb0ea3d22ddac531123c797044d6acf59ce90149ae84939176e5e51e24ac1310280b858610edb68a241d609b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c9ed1fe36bf77c3d3d318d1eaa781e05

SHA1
16e45011b14dfd1bf012186f40339791b75e1442

SHA256
06cd342256a514bee399b50497874868bec31cad1b09579fed87b2e809d84532

SHA512
748691a1e88d38d7d89b103f77d52090f38d962f80a47a1a39be285a3165a8eade217c9e3f3d384508029331ce68c990363f1e4950843703f478b1ef1ea96aef

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
10e6f053cfd27a843dc6fe73f2943e83

SHA1
0e70050fdcdaa27797511f5190b86da505da487c

SHA256
1680ea9e4660c34480fd7f2dce33252ef45ff7b3705d47737a0a7e5597754b5c

SHA512
6ee6ca9517fbc9ee174fdc6a7277a9bdb3da5503b481bbe624f367804db11ebab3941c39b17ddcfed83a67058e7bcc752ce5a9099c09ee076d7d64f576ad30f9

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
7b1746353c60d7adb7e29b82c993b678

SHA1
5b8526269b6edfb4c927a929d28ea536bd3d806d

SHA256
debe2342982edeb2dc8a71ea626d3c1029e37b1dc1ad5d23f4cef2d0803c8f59

SHA512
cf2feb3a59704bbbc307d8ad0b68937363755e789b5a26ebbbe1ed5e50038bab891be34d530b99d945857ca01057ad0dc2890f24fbf7989d8a1011d9e0d9b737

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State

Filesize
904B

MD5
fd89e20f85d707b57a257ff43b822456

SHA1
45067a13c5380bdf9d0f8c2de4dd2dcccadbc00d

SHA256
51a92e74b60c92c98cfe1b9438eaf6ae654f0243a547c12ec6d4e6070f80a603

SHA512
1a89024ff7cd1bf2a1762423d92b770e845fa18c7a6a81f374a8a9860655449e375575b75d98253feba9db7b1684ed429060e6bf89ae96bcce9a5c96c83a8e61

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe58c03e.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity

Filesize
692B

MD5
ae1334ee0e07065007a8082536831791

SHA1
747b3e40e6b156faf8667e20ba4f20b2b2b6bf9c

SHA256
7effacaf4ce228886719edcf11907e0f26195c23141583751ea5a34acdf3332d

SHA512
7dab1ab37bee873c60c9d59d1c87d8899d342491d57883285b3cfbadb490fb551717aa1392e54a28952d384042d5ce1b9b8cafa28bb9a129e86ae51d43dbfceb

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity~RFe58c03e.TMP

Filesize
692B

MD5
a8f4fe91694e0b2473643eff8bbca3b9

SHA1
323359649ac85963043c579caf8255ed3ef86b29

SHA256
3f59416efab541af6ce0af87d8ae7ff47c1a4632bf823aa416ca0cffaf771454

SHA512
66bb30b105c5de73b5521d7c4f02233f03d7d9565961dc62412c9f54a752bd188f8f372d28de9274af66614d738c5d9ed58a5f98d6f433d78a0d583629e1071b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
738B

MD5
23d5a9165f0c27be51d3f5dafa2a3562

SHA1
9140e8511c64d0ed6d38dc8b9b07b647daa03b8e

SHA256
c13f0bc41d791fbfeb0447720e705588d30bf704632daa62c475c57cfbe8c599

SHA512
32a11ceb35a3d4a984d0c1133540aa6f3348cafeaf55ed1cd42f9558ebb09524d41a2c97739f7454093a3d85a58fbf781ac0e394640f8e4e2d8512ab34351ac7

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe58920a.TMP

Filesize
529B

MD5
a36dd7c1e38166d4d670bb026aaf4986

SHA1
1d34e4f668c97fd2a5650897edc26cdcd94fc9d5

SHA256
55217af5639aeb4cc5e3be77a821c7d3973e6181c88b4c8043c95ec1446d8bde

SHA512
ffb482bd13101428eb867ec95aed8ba5a583ece323c04f6f7651a497384ec329a78d586b6f7a1194b7153d67c0ff6178f3c1e1889f7c1b7f141e746c15e91077

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
395d45b6f7946b923e83becd8ba18385

SHA1
93ddfeeb73029897708fb669fbbdfbf1cc3e9821

SHA256
582080970ff435acc3c5f6b6e093372b5eec07bb32cf477ded8e83ec1ca2c0c5

SHA512
d6acb7d741a331b025a33e0c962371d5c94ea134063470d0f193b6610e76e3af59de3d8927ada8a905b43fec8e938b898f0c00d74266e866c1ab1cb63db539fa

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1qkmscli.hzg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
3.5MB

MD5
a122ee81fdc6e886f0a1383a338fbf98

SHA1
7661d511f29da099a3d0aea247af7270c3096fa1

SHA256
ce0222d9881a1953d9bebf0358972c47aeec3d4b3780fcc8c4d103b0f497058e

SHA512
1d62491fc6527e8a920e8a5270c7749a021aee46b79ec7e7cc0c1c734bad93e963a83599add927a8c55777bc93fd260475f290b5657b18b7b176a3f8112ad4c8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
7.0MB

MD5
86cb9c8b95b928f4a25653dc8e2efdc8

SHA1
4a939e375604111b7534fe4a7d80240651b7b1b0

SHA256
53dad9afaabfde27e3bd4ec6e17e4f32b2858dd64ccd08929b3b7ec2370f4d38

SHA512
21c70aea6585280fe1ef04f1e04200722d0611be94be06b58d8e9b8593460e7e2a11322820a89e3e2965f091d41b6e46457c3a37d2ba1d34d9e2b09a6217a0be

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
3.1MB

MD5
c2030e7ec911edd07bbb0231aef180dc

SHA1
63349dab8fa45c3dd975aa21757e3cc0c43a100e

SHA256
48e48e353647679d69455db6f04a9c6d27aa9742fc1b8a417edc4af2e7475150

SHA512
e863d16b727aeb4f24aec1b00878bd025bb519a79e024bd33c7557137b74c6696a40d196112e96053663f68e879c2d799757b0d7e90d287c5872176d1cc45ef0

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
26.0MB

MD5
e1adbcfc8098bb7ceaf3fb36d635d725

SHA1
ac868be50cac636a6bc85cf1bafbc4fe1cd78c1f

SHA256
6c41106e09abdb08271440e475310b065f87a16a08d027546aea113c96f3458d

SHA512
690b029d2cc3b3d3d20d6a989399b65efedc494a6b78c060ae1497d77243ec69d6acb2e7c8e3d9ab00366ff839544ae17365df3c7bbbed39836088c892795e71

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
26.0MB

MD5
99e89c9678a27d5df3f95233c0d54e5e

SHA1
a7b85a91463840d4b00195ea2c802f153eb779cd

SHA256
799133190ae4c8dbc01fbb80b79d4768d6e8da0358b09cfc1556847975663319

SHA512
70de5bed924eab8d61b3644b6212ef486602ce83fe1e2366739041a35475563ada64b8196dc31ba8e42965b9a1e2ce427c94210194e62e7ebf51bad1dcb578d8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
667KB

MD5
6c66dfb43b302bb2f59bdb0941fee3f0

SHA1
d150584a60b362d292d52b52b0ce0e81d3835d3b

SHA256
adebb2921cc84e02bbf9417a16ebe18d84938fd27475b517b36a0da9da505ac1

SHA512
f07b6c9008e4dc0e8aaa6b95a4d2b1a1fb437a8d646a973fc7b98f7bfac42df7a50bd83767daf9959976e720eb7dc9eb256838e1dda36c1700de9f1aea07390b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
744ecf3e5f1b18e950533e0d42e6d4ad

SHA1
bb9a9ee40649a3f5bd2e7f46e16c7e5e139b7e54

SHA256
a3cf8aa391aad9d995670099cda3ec390956cd6eb97ac90ecd1d259ba466486e

SHA512
189bfe2a3e5e5a2fdc46128745244c68a7a86fa9bc3af48753e9efdbc229ec3b01c800ee285713656ee93e51a9c4a0a13bf52bdbf818994624929938661d5323

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.0MB

MD5
84c90cdc355e732c1145eb68f71b5f60

SHA1
4d1b4fe5c87f8cacb1638482c6e02fd8208491f6

SHA256
0eba3e867be98053f8451214dad77dcbe92033f403fdeb411164749ee9052b83

SHA512
4fc7aa74276d736cb2cdb68220f70afedfdd9a6cad6bf372e39d4a69f08e444faecd5ec40af8d7cc3a40856dcbbbe13f209b1b2a22628b95225e67390416bf28

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
603B

MD5
44a6b9a523cb429518e080e8c12bbcfe

SHA1
aed99ff9667ccafcf729d437455da9ad8054aeed

SHA256
0e87ed193bb5a3afda2e73b90aa295fee38a466d2c416886be906942ffea4370

SHA512
c0b31094516daa676730b3687e0ac00d64f45f001e7bda46563610a91ef77639b028c8adb3f1891595dc32239b3bda8a8fd635e72fc4de68da8eee552b75cfc6

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
c081ba2b25cbbf4f7d0e1be55e6184e5

SHA1
0ffc0bea6c8694fd44c049c13c8c4e4290ff2284

SHA256
3d4252e46c3c8bec2fc8b377ab8565f87bb71fc7eacf073556df7879f01ee486

SHA512
9f89e8e6780f96b59014e7798d874678a197e7737265c54274c56ab2e583143375618cb4de477c97fd9ba1c84919e7efb545d7d906eb176b3f093c3a27a37174

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
372KB

MD5
758a64628b415c3b6bc3a8adce628739

SHA1
149e1f2e8adee2323374641a5c922b1d5e6cd817

SHA256
e9c8cbe6a44f170e6f2e8873fe05fb90a81861576a3669b78d7d305c9c1eda3b

SHA512
51ef51fb74cac87cf1c1bc05187c1456f841a62d3caa2f2229ab4751a24fdb14bb4528e17c4400604844853380e6542fd7aacd4f26cb94b4d19f700d2334c58a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
6.7MB

MD5
516cd4cc29d5b9f2796c15c40c4cfa25

SHA1
ba139192de5dbc7e563be7e9beaf7aedf56247ea

SHA256
1281462c613c88e0cd69f73937c55e7125c5572a38888bccab14012ce9e8c2dd

SHA512
08a86fb45665c2be6c2be8b1ce6b2700ea1449d3363f5fa96c00d4efea08100391785231c1abe3c4b67c03a93331b124a89f849ef31d0f4d0c2378cd748c6744

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
459KB

MD5
d74fa66466d377a2e5ea85c7142895d6

SHA1
4976fa62b0fc60a92c4a84d7e4b1ab939ed7bfbb

SHA256
dd2c824c1b8365c730fb91ae90f90d0e1115f444d36fd90097b2544e24822205

SHA512
7010936923a8414ebff0197b647a387729f86e6e0fd5166726fed0c9410fcb7644fd3632aa4fe492428efff2e451119fc86e0f85df8a0a93ef071db1800df623

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
2cfe980c0024751358360372fe4bc2b1

SHA1
4d926cf61c0e9d27ff847fc3446f049dbd1da192

SHA256
3905cd0af0025adc86548e2f47d68461408a2e2800d66669c9fdf7829c53dee1

SHA512
8bc0f5ee1ded4c693f0e239fdc308626da2d32cf86997d93e000d8c5bd89e42d77a3e058fe548e6f4aeeb5d1e9391f308071bad6b55212500d9dd7cc1bacc6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.1MB

MD5
5d169d0b80ebd3c7d3fc517d9e13f007

SHA1
ab43a52fbbb3994f4c3a90688b14592353701f9b

SHA256
8aa4a2089231bd8262e988b10d2cb0428a38fa3c6c28f90d00c4437e83cc6d3e

SHA512
e39e0616ea3b904b2f0c512eb5c551aebe407a95baecaa73fa484211c347f128506c305986b26634d4fe3b4339f05251594a8ae2b167f65378aa7674edb5fab8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
646KB

MD5
c88eaf4b5425931be67e9990bbde9974

SHA1
64baa73d939eddb56b190428e7101d600ff5f414

SHA256
d0a5149aa01ae1f1498b4b9a1f76fb7818501e87b64df79ca96a7a2b0ca36ecd

SHA512
a2c40a7f127f45af62d526fcc3a123e5b5356bd2728ed4e1c3fe238bad27be453ef53659d18e21ae678437f7516a0f91e5d44e38e00403384f9e06da01f1248c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.4MB

MD5
c6b3a71fbc6f2e92b0ef21a1afaad305

SHA1
18af6255a762d4fc8fab3cce04e4525faf2f6f23

SHA256
e987fab8d40833f084722ebef66ba23ef4fd0189c190ea9b53e1e7ab406a4505

SHA512
b24dd9bb7d16ea470104de70b807825bd2402487cc9d5ae9feca1621e94e939bf2caefb650382db70ee94b0b17a3a9796af44e84a64c7f69705fa75ed05bf15a

Download Submit
C:\Users\Admin\Desktop\Spotify.lnk

Filesize
1KB

MD5
03b8fbe7431d3554f3e4ffc8f8aaff4b

SHA1
4183dd627c661386f3aec0551a26c7c6c0617e01

SHA256
3144df65758234b0066a4e1ea8debaa65a516abc448cc643dc604fb90f47efe2

SHA512
a54d4dd2054d8e8bd733262eebc05dc1e11c7547503216281667bc9b87dbbd391c12f0f5d4b0dc3a05e63fca2616fc0a145059baee45a6d22c77c50f5cf0b60d

Download Submit
memory/1176-262-0x00000000002A0000-0x0000000001CC1000-memory.dmp

Filesize
26.1MB

Download
memory/1176-743-0x00000000002A0000-0x0000000001CC1000-memory.dmp

Filesize
26.1MB

Download
memory/1176-430-0x00000000002A0000-0x0000000001CC1000-memory.dmp

Filesize
26.1MB

Download
memory/2672-229-0x0000000000060000-0x0000000001A81000-memory.dmp

Filesize
26.1MB

Download
memory/2672-226-0x0000000000060000-0x0000000001A81000-memory.dmp

Filesize
26.1MB

Download
memory/4400-23-0x00007FFCA41F0000-0x00007FFCA4CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4400-20-0x000002855D0F0000-0x000002855D116000-memory.dmp

Filesize
152KB

Download
memory/4400-231-0x000002855E8B0000-0x000002855EDD8000-memory.dmp

Filesize
5.2MB

Download
memory/4400-232-0x000002855E000000-0x000002855E00A000-memory.dmp

Filesize
40KB

Download
memory/4400-29-0x00007FFCA41F0000-0x00007FFCA4CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4400-233-0x000002855E030000-0x000002855E042000-memory.dmp

Filesize
72KB

Download
memory/4400-258-0x00007FFCA41F0000-0x00007FFCA4CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4400-26-0x00007FFCA41F0000-0x00007FFCA4CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4400-0-0x00007FFCA41F3000-0x00007FFCA41F5000-memory.dmp

Filesize
8KB

Download
memory/4400-24-0x000002855C930000-0x000002855CB4C000-memory.dmp

Filesize
2.1MB

Download
memory/4400-10-0x000002855CC80000-0x000002855CCA2000-memory.dmp

Filesize
136KB

Download
memory/4400-22-0x00007FFCA41F3000-0x00007FFCA41F5000-memory.dmp

Filesize
8KB

Download
memory/4400-21-0x000002855D1A0000-0x000002855D1B4000-memory.dmp

Filesize
80KB

Download
memory/4400-230-0x000002855E1B0000-0x000002855E372000-memory.dmp

Filesize
1.8MB

Download
memory/4400-19-0x000002855D120000-0x000002855D146000-memory.dmp

Filesize
152KB

Download
memory/4400-18-0x000002855D0B0000-0x000002855D0BA000-memory.dmp

Filesize
40KB

Download
memory/4400-17-0x000002855D090000-0x000002855D0A6000-memory.dmp

Filesize
88KB

Download
memory/4400-15-0x000002855D090000-0x000002855D0BA000-memory.dmp

Filesize
168KB

Download
memory/4400-16-0x000002855D090000-0x000002855D0B4000-memory.dmp

Filesize
144KB

Download
memory/4400-14-0x00007FFCA41F0000-0x00007FFCA4CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4400-13-0x00007FFCA41F0000-0x00007FFCA4CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4400-12-0x00007FFCA41F0000-0x00007FFCA4CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4400-11-0x00007FFCA41F0000-0x00007FFCA4CB1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-280-0x00000000002A0000-0x0000000001CC1000-memory.dmp

Filesize
26.1MB

Download
memory/4616-440-0x00000000002A0000-0x0000000001CC1000-memory.dmp

Filesize
26.1MB

Download
memory/5336-754-0x00007FFCB8A50000-0x00007FFCB8A84000-memory.dmp

Filesize
208KB

Download
memory/5336-753-0x00007FF659670000-0x00007FF659768000-memory.dmp

Filesize
992KB

Download
memory/5336-755-0x00007FFCA4150000-0x00007FFCA4406000-memory.dmp

Filesize
2.7MB

Download