Analysis

  • user interaction
    yes
  • max time kernel
    30s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 04:31

General

  • Target
    SpotifySetup.exe
  • Size 1.2MB
  • Sample260816-e5e68szzfy
  • SHA256 718ba1cb98b42de2c4609953531e6b255e31ca31fd3645cb98b2ca040763fea3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 2 IoCs
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Modifies registry class 9 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe
    "C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
      SpWebInst0.exe /webinstall
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4192
      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        Spotify.exe /INSTALLCOMPLETE
        3⤵
        • Executes dropped EXE
        PID:3868
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.96.518 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffbb0245448,0x7ffbb0245454,0x7ffbb0245460
          4⤵
            PID:4808
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=2428,i,14255551781273653972,1474270462823457822,524288 --field-trial-handle=2508,i,11048300162092813163,14467544858637834121,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2512,i,6655346387450845378,4684038938029754290,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2628 --mojo-platform-channel-handle=2616 /prefetch:3
            4⤵
            • System Time Discovery
            PID:1616
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2200,i,7637068518437718489,13025256056981130761,262144 --field-trial-handle=2508,i,11048300162092813163,14467544858637834121,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2512,i,6655346387450845378,4684038938029754290,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2516 --mojo-platform-channel-handle=2504 /prefetch:2
            4⤵
              PID:4304
            • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
              "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=2916,i,9708503474371914942,6696264833076712590,524288 --field-trial-handle=2508,i,11048300162092813163,14467544858637834121,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2512,i,6655346387450845378,4684038938029754290,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=2980 --mojo-platform-channel-handle=2976 /prefetch:8
              4⤵
                PID:4224
              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1786854149045618 --launch-time-ticks=577064621 --metrics-shmem-handle=5868,i,1049212475835006555,1322300422275801748,2097152 --field-trial-handle=2508,i,11048300162092813163,14467544858637834121,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2512,i,6655346387450845378,4684038938029754290,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=5896 --mojo-platform-channel-handle=5892 /prefetch:1
                4⤵
                  PID:5060
                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=7408,i,8784019899257514874,1746170751954971860,524288 --field-trial-handle=2508,i,11048300162092813163,14467544858637834121,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2512,i,6655346387450845378,4684038938029754290,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7416 --mojo-platform-channel-handle=7412 /prefetch:8
                  4⤵
                    PID:4200
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
              1⤵
                PID:512
              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
                1⤵
                  PID:4656
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.96.518 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffbb0245448,0x7ffbb0245454,0x7ffbb0245460
                    2⤵
                      PID:2576
                  • C:\Windows\system32\werfault.exe
                    werfault.exe /hc /shared Global\180446a5d2a349e3bec58fe86187a272 /t 3892 /p 3860
                    1⤵
                      PID:3356
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:1764

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            AppCache134313283689647147.txt

                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134313283689647147.txt
                            • Size 89KB
                            • SHA256 a8e1b3561743a48caf10fa155d368ac018e7531cc1ab856a0cb3215be4935310
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            index

                            • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index
                            • Size 24B
                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                            • MD5 SHA1 SHA512

                            data_0

                            • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
                            • Size 8KB
                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                            • MD5 SHA1 SHA512 SSDEEP

                            data_1

                            • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
                            • Size 264KB
                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                            • MD5 SHA1 SHA512 SSDEEP

                            data_2

                            • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
                            • Size 8KB
                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                            • MD5 SHA1 SHA512 SSDEEP

                            data_3

                            • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
                            • Size 8KB
                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                            • MD5 SHA1 SHA512 SSDEEP

                            SCT Auditing Pending Reports

                            • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512

                            Preferences

                            • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
                            • Size 10KB
                            • SHA256 d78d8e3e19e95a895a28d215100975abeadb37aea31b2070682928302e471148
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Preferences~RFe59d94f.TMP

                            • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe59d94f.TMP
                            • Size 9KB
                            • SHA256 29a0e3e3855c45b8804d81fee346aa874d2cdf0cf1906124a0b49558d19e9831
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            MANIFEST-000001

                            • Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
                            • Size 41B
                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                            • MD5 SHA1 SHA512

                            Network Persistent State

                            • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
                            • Size 59B
                            • SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
                            • MD5 SHA1 SHA512 TLSH

                            Network Persistent State

                            • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
                            • Size 59B
                            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                            • MD5 SHA1 SHA512 TLSH

                            Preferences

                            • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
                            • Size 8KB
                            • SHA256 38adc1d78d5bce7d86de4dd5e9fbf0b2d5c54f094b4863c0238dc579237d7a39
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Preferences~RFe59d920.TMP

                            • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe59d920.TMP
                            • Size 8KB
                            • SHA256 62761e52f71f6fcc68b656895ff80b70c303fd857882f978773e3b584df8a230
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                            • Size 3KB
                            • SHA256 735254db9045387284b74130528763708379c94ccc6c2ebaffcb52013b6ffcd6
                            • MD5 SHA1 SHA512 TLSH

                            Local State

                            • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                            • Size 6KB
                            • SHA256 0cc81e4aeb7eac7e519b2f1befdc5843ab1e1b426815909dd6c005e69ab75244
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Local State~RFe59b349.TMP

                            • Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe59b349.TMP
                            • Size 1008B
                            • SHA256 d099c246d53ac2aca44102139035c1827d9cb0a5db0427eb1038793579449170
                            • MD5 SHA1 SHA512 TLSH

                            settings.dat

                            • Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
                            • Size 56B
                            • SHA256 086b88dac750f59f9d6a70031b1ef3e45ba99c404090851a35be63bd0149bf24
                            • MD5 SHA1 SHA512

                            ac78a578-98b5-42da-8736-e74a5f9c2426.tmp

                            • Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\ac78a578-98b5-42da-8736-e74a5f9c2426.tmp
                            • Size 13B
                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                            • MD5 SHA1 SHA512

                            000002.dbtmp

                            • Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
                            • Size 16B
                            • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                            • MD5 SHA1 SHA512

                            CURRENT

                            • Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT
                            • Size 16B
                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                            • MD5 SHA1 SHA512

                            login.spa

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
                            • Size 3.9MB
                            • SHA256 ab20e5730ce3e31c1b8f0ba62fab40a20205d9faf2c8c748d0f02330c181609b
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Spotify.dll

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
                            • Size 40.5MB
                            • SHA256 e3fb0cf4b033c7fd689e5a1486c3fec298c263f73868b6085ab4671b35ad538d
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Spotify.dll

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
                            • Size 33.9MB
                            • SHA256 038cdc4bbc565e2ec771ab3fc9b85e41c2fb0e71530231dde222147a4c7dfa44
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            Spotify.exe

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                            • Size 2.8MB
                            • SHA256 31a16d06a39339c3b9befef9089b17e4a45b946bccae668b569157ee244b2a7c
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            chrome_100_percent.pak

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
                            • Size 705KB
                            • SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            chrome_200_percent.pak

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
                            • Size 1.2MB
                            • SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            chrome_elf.dll

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                            • Size 2.4MB
                            • SHA256 24eafefff6b2d53bc408ee41b0607229c111afa07dbdc04d71ad5a25b43027c2
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            crash_reporter.cfg

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
                            • Size 632B
                            • SHA256 33f70749cdc5ecd6bb047147a2e767d7a279c631f6524ebb1b1df60e6bf93d6e
                            • MD5 SHA1 SHA512 TLSH

                            d3dcompiler_47.dll

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
                            • Size 4.5MB
                            • SHA256 3b01ff1bc4a18b63a790c5f6de8e17573de4c5280570ad8677a7767fad304af2
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            icudtl.dat

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
                            • Size 10.3MB
                            • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            libEGL.dll

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
                            • Size 504KB
                            • SHA256 f9ee6e166b95763900af0937ada47b11c5d1129f49f7dfeadaa18fb10d0b1efd
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            libGLESv2.dll

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
                            • Size 7.5MB
                            • SHA256 630a0e4217d83078b074a1d66e4a4723f9e4f310b24ba0e6a8c3092837b851d1
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            en-US.pak

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
                            • Size 577KB
                            • SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            en.mo

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
                            • Size 16KB
                            • SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            zh-Hant.mo

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
                            • Size 16KB
                            • SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            prefs

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\prefs
                            • Size 154B
                            • SHA256 9907ff9ac2c57f7da8ab95f0487116377f50757cd6150df584e453d0ab710db8
                            • MD5 SHA1 SHA512 TLSH

                            resources.pak

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
                            • Size 17.8MB
                            • SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            v8_context_snapshot.bin

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
                            • Size 16.8MB
                            • SHA256 148fb1b705a31315ee286cfc344c9e0279d0cd43d386ae4f381e7846a34e434b
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            vk_swiftshader.dll

                            • Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
                            • Size 5.2MB
                            • SHA256 a92fba6360ddc71779d8ec480f21d4959f5f6c10db24741e19c6ddb0d6ffe85e
                            • MD5 SHA1 SHA512 SSDEEP TLSH

                            memory/3868-702-0x00007FFBAD3D0000-0x00007FFBAFC84000-memory.dmp

                            memory/3868-338-0x00007FFBAD3D0000-0x00007FFBAFC84000-memory.dmp

                            memory/3868-337-0x00007FFBAD3D0000-0x00007FFBAFC84000-memory.dmp

                            memory/3868-666-0x00007FFBAD3D0000-0x00007FFBAFC84000-memory.dmp

                            memory/4224-621-0x0000017064E10000-0x0000017064E7B000-memory.dmp

                            memory/4224-377-0x00007FFBCBAB0000-0x00007FFBCBAB1000-memory.dmp

                            memory/4224-429-0x00007FFBCCCB0000-0x00007FFBCCCB1000-memory.dmp

                            memory/4304-619-0x000001C15FCF0000-0x000001C16017D000-memory.dmp

                            memory/4304-753-0x000001C15FCF0000-0x000001C16017D000-memory.dmp

                            memory/5060-639-0x0000021F0E110000-0x0000021F0E17B000-memory.dmp