Overview

overview

10

Static

static

3

2026-05-22...ar.exe

windows10-2004-x64

10

2026-05-22...ar.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/05/2026, 18:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe
  • Size 1.5MB
  • Sample260522-xdmfcadt7n
  • SHA256 7d5e454f983af61767acab18de9ab8122a551bf1783a8ab2e95c7d971b83f8cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 55 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 24 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 13 IoCs
    adwarespyware
  • Modifies registry class 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1680
    • \??\c:\users\admin\appdata\local\temp\2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe 
      c:\users\admin\appdata\local\temp\2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe 
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
        SpWebInst0.exe /webinstall
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          Spotify.exe /INSTALLCOMPLETE
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2952
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.90.451 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff983cb5448,0x7ff983cb5454,0x7ff983cb5460
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3744
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2256,i,4487662258194012689,5197897952209603365,262144 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2456 --mojo-platform-channel-handle=2444 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3112
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=2676,i,15457649064074237418,1222451610401585665,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2740 --mojo-platform-channel-handle=2736 /prefetch:3
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:2980
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=2904,i,5391716661066235006,15968732510975275657,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=2792 --mojo-platform-channel-handle=2788 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3648
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1779474954466492 --launch-time-ticks=542828214 --metrics-shmem-handle=6192,i,4152664626497418713,9312804139400400707,2097152 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=6220 --mojo-platform-channel-handle=6216 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:540
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7484,i,2621977118639456666,13064415474631858986,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7492 --mojo-platform-channel-handle=7488 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5444
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7772,i,10108086644162146232,7689937962513090546,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=3744 --mojo-platform-channel-handle=4848 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5580
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7740,i,17901822075159070626,10331412795693751085,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=1420 --mojo-platform-channel-handle=2276 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6032
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=3852,i,12002316900509255998,1480348449744249140,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708995682289984 --enable-logging=handle --log-file=3836 --mojo-platform-channel-handle=7636 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3784
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=3904,i,12529815878120182090,5397856146265330091,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=7752 --mojo-platform-channel-handle=7772 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5632
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7808,i,15208881832971356362,561344837975463008,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708997556373682 --enable-logging=handle --log-file=7856 --mojo-platform-channel-handle=7868 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5520
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7892,i,7126818019198584299,14494379097828323438,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708998493415531 --enable-logging=handle --log-file=7324 --mojo-platform-channel-handle=7808 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5908
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7752,i,15065937805086309495,16885751591344757830,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190708999430457380 --enable-logging=handle --log-file=7892 --mojo-platform-channel-handle=7324 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3172
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=3876,i,8228782607661381398,6944616169096949658,524288 --field-trial-handle=2448,i,2506056949831264900,3357528303381732347,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2452,i,14657924632437498458,17219162680954464616,4 --trace-process-track-uuid=3190709000367499229 --enable-logging=handle --log-file=7744 --mojo-platform-channel-handle=7496 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3780
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4964
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3504
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:8
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:732
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3024
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:1352
    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4524
      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.90.451 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff983cb5448,0x7ff983cb5454,0x7ff983cb5460
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:228

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          manifest.json
          • Path C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping2952_1206786988\manifest.json
          • Size 108B
          • SHA256 036ae2f8504073e5719ba8095a546d8f5652d403b203666221638b2eb7ba2efb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping2952_1831458018\manifest.json
          • Size 1001B
          • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping2952_1855550296\manifest.json
          • Size 114B
          • SHA256 315263ad73d97e1033635360e556076d32d23e4398aa57a4c867203f4709465f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping2952_541749737\manifest.json
          • Size 79B
          • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Program Files\chromium_chrome_Unpacker_BeginUnzipping2952_568682748\manifest.json
          • Size 108B
          • SHA256 ba6fcb8964f3dd492fec803586a6cf000789745e0f6dee9a89f7eb1ab9d470be
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
          • Size 72B
          • SHA256 b2a63c8892e6ad61f878aca3ad85f6be588e4d8705d78885dd7b037dcaf7036d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index~RFe591d33.TMP
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe591d33.TMP
          • Size 48B
          • SHA256 87f53ffeb04ea500502db1b943dbaf6322e12a06f09a26ad7432aa357bf44b58
          • MD5 SHA1 SHA512
          Submit Download

          data_0
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_1
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
          • Size 264KB
          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_2
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_3
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
          • Size 2KB
          • SHA256 7feb1ce5442be1e13f56b5753c565250ed7eabc25be2dedb48b9c406f4598b6a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
          • Size 10KB
          • SHA256 4d4762266a6738760b235939fc37fe053fd4a4231964ca183cf5df590d3023e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
          • Size 10KB
          • SHA256 04c3e4b9fffd557b2572ac4eb24393295687a67bbf02f7ffa506c86bc0847467
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences~RFe58eac8.TMP
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe58eac8.TMP
          • Size 10KB
          • SHA256 ceebcc6d207c7e739a3b69880ecef83b4871da65c4a91bdb82a0646ca479f723
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Scripts\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
          • Size 922B
          • SHA256 1fb71983c5ab02e590d27170a897e0cd50337fb3717f83c6b8df8ca58b0e0413
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
          • Size 8KB
          • SHA256 81d12a3f6ca483eab43c03348a76a2add9c5f735de0c279869f185a889b2593f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
          • Size 8KB
          • SHA256 6e9156232a74982ec4f67319e5741597576190596e3e4a6b32fa721697341d38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences~RFe58eac8.TMP
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe58eac8.TMP
          • Size 8KB
          • SHA256 27391a23667adb189c9b857b6bd2c95c8af3d80bb08e3299a75a247a3aad516f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Shared Dictionary\cache\index
          • Size 24B
          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
          • MD5 SHA1 SHA512
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Spotify\Local State
          • Size 6KB
          • SHA256 32236f792b81e6e90715a271c7cf23bc313f2a0e86671c7c3cfae2c4808b427b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Spotify\Local State
          • Size 3KB
          • SHA256 22165f11b57c79f36fe0eccb4423fcb9a13df043a2496fca66465bd00f862f34
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Spotify\Local State
          • Size 6KB
          • SHA256 ad34dce5d64b5ab29c88490d409ab25750055b9b77a31f2dfc9b35d38e524f28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State~RFe58bc85.TMP
          • Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe58bc85.TMP
          • Size 1006B
          • SHA256 a3af777017e16721ded4072e23a9c8a1377deac92ce2d00da43e296c23b86e7c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          optimization-hints.pb
          • Path C:\Users\Admin\AppData\Local\Spotify\OptimizationHints\677\optimization-hints.pb
          • Size 483KB
          • SHA256 eca70faa5a0fd50460fdb54bfdb0b815fdc506f9128400d7dd072ce19044c546
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          manifest.json
          • Path C:\Users\Admin\AppData\Local\Spotify\PrivacySandboxAttestationsPreloaded\2025.6.16.0\manifest.json
          • Size 97B
          • SHA256 335b1566f2a398f764be95e60ea16352e087262dfffa2616576bb22947d7e4bc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          privacy-sandbox-attestations.dat
          • Path C:\Users\Admin\AppData\Local\Spotify\PrivacySandboxAttestationsPreloaded\2025.6.16.0\privacy-sandbox-attestations.dat
          • Size 7KB
          • SHA256 d5fbb03c2733c6670d21968bd057f315d56640f4e9dc3333f60e0b81fe3920d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Filtering Rules
          • Path C:\Users\Admin\AppData\Local\Spotify\Subresource Filter\Unindexed Rules\9.68.0\Filtering Rules
          • Size 152KB
          • SHA256 c94b69e368b739a6326a77e04e5a49a4caa6294b0e784bf94173d6730f46570a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          keys.json
          • Path C:\Users\Admin\AppData\Local\Spotify\TrustTokenKeyCommitments\2026.3.23.1\keys.json
          • Size 8KB
          • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
          • Size 56B
          • SHA256 90a8c8e6a3300bb04a7b36065d71a1ab447f8242a32283f12fd0045d1156081b
          • MD5 SHA1 SHA512
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
          • Size 236B
          • SHA256 04447d9dc66df222dd2d99db47ad7e5117a559717bb105f3e4bf516293d6d7e3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
          • Size 572B
          • SHA256 f74c5b48362370e8510493486d117e7088453c1cdc73a26c71100a5130f2d039
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
          • Size 348B
          • SHA256 3be534d9e15a39ae1b4b229ed1337efbeee847c6d907c05f8afb8b77f9f1036a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
          • Size 124B
          • SHA256 418e37a64c865013c87c6d30e5094d292fa74fb46e449d968ac83f492e46407b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
          • Size 460B
          • SHA256 6f01c6d8d03ae20d1d4f481d712b0d58cb1a41105491e1ff33428b89ec7c48f7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          80fbda72-b085-40be-aebc-3dd79fcb8896.tmp
          • Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\80fbda72-b085-40be-aebc-3dd79fcb8896.tmp
          • Size 13B
          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
          • MD5 SHA1 SHA512
          Submit Download

          000002.dbtmp
          • Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
          • Size 16B
          • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
          • MD5 SHA1 SHA512
          Submit Download

          2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe 
          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe 
          • Size 1.4MB
          • SHA256 9d2f39c5a398da813ddaa106ec1ce49c53319091703fde018a2058ef98504c17
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          login.spa
          • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
          • Size 3.8MB
          • SHA256 72f7f40d5a65a0074c2745ca485a609e835f8abf2429c8dbd795174bac5c0bd6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Spotify.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
          • Size 39.5MB
          • SHA256 1410132f753656fbdb18ad9fb7f94565000c85704b3f4db48c1ab705d367ea7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Spotify.exe
          • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          • Size 2.8MB
          • SHA256 305e8f96a7bfb83f600d4f4dec4d169ab9dd4d5cb7b77b2e1da28cfbe2d58cc6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_100_percent.pak
          • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
          • Size 705KB
          • SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_200_percent.pak
          • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
          • Size 1.2MB
          • SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_elf.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
          • Size 2.4MB
          • SHA256 9eaf3adaf1ef4a7f0639e6e2b1855bfe2125271342faeb2eac40d2039e84d8d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          crash_reporter.cfg
          • Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
          • Size 632B
          • SHA256 edc24259c1f3013abdb8c6262b5c8aa9d3656ba38e515f88cc797bf5b9456b31
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          d3dcompiler_47.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
          • Size 4.5MB
          • SHA256 68ff9808c208eef52df74895a29ce184335a6332aad3cebbd64f6111805bc745
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudtl.dat
          • Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
          • Size 10.3MB
          • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libEGL.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
          • Size 504KB
          • SHA256 3f7027612c5f2b472fb725f2869666ad2a5e9e4e0d7c8c0d82c21450741ccc11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libGLESv2.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
          • Size 7.5MB
          • SHA256 63aca2cc923b97b55dfc47146cae1cc3abf744c204ac4305ef3acc53704af8ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-US.pak
          • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
          • Size 577KB
          • SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en.mo
          • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
          • Size 16KB
          • SHA256 aa146c3fbb7af8381836b0c7c2569a13c1494c26994b996f94cebf272b59fa9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zh-Hant.mo
          • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
          • Size 16KB
          • SHA256 df81711e5812dbd894e74e1904006138c4358659b5175899df0bb9db10e57bb1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          resources.pak
          • Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
          • Size 17.8MB
          • SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          v8_context_snapshot.bin
          • Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
          • Size 16.9MB
          • SHA256 0b1f4967da6aedb84344403dea789cee0c2836ec06e5725d05f900bd36f8ca90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vk_swiftshader.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
          • Size 5.2MB
          • SHA256 f64e64c7e88f00bb04b8264536e201291e9a3d669c36bd238cbaef8c26b62349
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          explorer.exe
          • Path C:\Windows\Resources\Themes\explorer.exe
          • Size 135KB
          • SHA256 1e01138393a0d75d0e87c2fa83e3fda1076e2b9345c5aaf15bcec8771b72d9ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icsys.icn.exe
          • Path C:\Windows\Resources\Themes\icsys.icn.exe
          • Size 135KB
          • SHA256 10175f2413a3303e7640d955d3ef1ecb8474bd67a18935e7951e90271f0f6a9f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          svchost.exe
          • Path C:\Windows\Resources\svchost.exe
          • Size 135KB
          • SHA256 3041c2589b696097bb3d6fe72042694a862980555bc3e6da94d40e8f73d117e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spoolsv.exe
          • Path \??\c:\windows\resources\spoolsv.exe
          • Size 135KB
          • SHA256 223c9804b7512724375e48626a78b04948254c02d70c233abb103e9cefa1748d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/8-47-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/732-914-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/1680-49-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/1680-0-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/2952-380-0x00007FF981280000-0x00007FF983A46000-memory.dmp
          Download

          memory/2952-381-0x00007FF981280000-0x00007FF983A46000-memory.dmp
          Download

          memory/2952-719-0x00007FF981280000-0x00007FF983A46000-memory.dmp
          Download

          memory/2952-655-0x00007FF981280000-0x00007FF983A46000-memory.dmp
          Download

          memory/3024-46-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3112-745-0x0000020049A30000-0x0000020049EBD000-memory.dmp
          Download

          memory/3112-680-0x0000020049A30000-0x0000020049EBD000-memory.dmp
          Download

          memory/3504-897-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3648-443-0x00007FF9A0890000-0x00007FF9A0891000-memory.dmp
          Download

          memory/3648-442-0x00007FF9A0610000-0x00007FF9A0611000-memory.dmp
          Download

          memory/4964-12-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4964-48-0x0000000000400000-0x000000000041F000-memory.dmp
          Download