8b78d1071a5c9add21685f9607f42010ef8c04fd4a789a45fe8678fde6ab1d24

Analysis

max time kernel
64s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlockTheSpot.bat
Size

265B
MD5

d2a6bb7593c8c2c054a65c6d2167197a
SHA1

721bc41054dfbdac908e11881e5c1885002a8183
SHA256

8b78d1071a5c9add21685f9607f42010ef8c04fd4a789a45fe8678fde6ab1d24
SHA512

48fbc3ef45ec6b1fe3fd6a6d832739308bcf84c4bd7fa83b7295e054a29dda15cc0b70d93ef43906c3c9fb4194e66eab02eb8863d2a1a5646c18d7b3a52984ca

Score

8^/10

execution persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
10	2988	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2988	powershell.exe
1288	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 7 IoCs

pid	Process
3860	Spotify.exe
4000	Spotify.exe
768	Spotify.exe
4660	Spotify.exe
3416	Spotify.exe
3780	Spotify.exe
1056	Spotify.exe

Loads dropped DLL 17 IoCs

pid	Process
4000	Spotify.exe
4000	Spotify.exe
768	Spotify.exe
768	Spotify.exe
4000	Spotify.exe
4660	Spotify.exe
4660	Spotify.exe
4660	Spotify.exe
4660	Spotify.exe
4660	Spotify.exe
4660	Spotify.exe
3416	Spotify.exe
3416	Spotify.exe
3780	Spotify.exe
3780	Spotify.exe
1056	Spotify.exe
1056	Spotify.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
10	raw.githubusercontent.com

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\spotify	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
1288	powershell.exe
1288	powershell.exe
1288	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeIncreaseQuotaPrivilege	2988	powershell.exe
Token: SeSecurityPrivilege	2988	powershell.exe
Token: SeTakeOwnershipPrivilege	2988	powershell.exe
Token: SeLoadDriverPrivilege	2988	powershell.exe
Token: SeSystemProfilePrivilege	2988	powershell.exe
Token: SeSystemtimePrivilege	2988	powershell.exe
Token: SeProfSingleProcessPrivilege	2988	powershell.exe
Token: SeIncBasePriorityPrivilege	2988	powershell.exe
Token: SeCreatePagefilePrivilege	2988	powershell.exe
Token: SeBackupPrivilege	2988	powershell.exe
Token: SeRestorePrivilege	2988	powershell.exe
Token: SeShutdownPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeSystemEnvironmentPrivilege	2988	powershell.exe
Token: SeRemoteShutdownPrivilege	2988	powershell.exe
Token: SeUndockPrivilege	2988	powershell.exe
Token: SeManageVolumePrivilege	2988	powershell.exe
Token: 33	2988	powershell.exe
Token: 34	2988	powershell.exe
Token: 35	2988	powershell.exe
Token: 36	2988	powershell.exe
Token: SeIncreaseQuotaPrivilege	2988	powershell.exe
Token: SeSecurityPrivilege	2988	powershell.exe
Token: SeTakeOwnershipPrivilege	2988	powershell.exe
Token: SeLoadDriverPrivilege	2988	powershell.exe
Token: SeSystemProfilePrivilege	2988	powershell.exe
Token: SeSystemtimePrivilege	2988	powershell.exe
Token: SeProfSingleProcessPrivilege	2988	powershell.exe
Token: SeIncBasePriorityPrivilege	2988	powershell.exe
Token: SeCreatePagefilePrivilege	2988	powershell.exe
Token: SeBackupPrivilege	2988	powershell.exe
Token: SeRestorePrivilege	2988	powershell.exe
Token: SeShutdownPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeSystemEnvironmentPrivilege	2988	powershell.exe
Token: SeRemoteShutdownPrivilege	2988	powershell.exe
Token: SeUndockPrivilege	2988	powershell.exe
Token: SeManageVolumePrivilege	2988	powershell.exe
Token: 33	2988	powershell.exe
Token: 34	2988	powershell.exe
Token: 35	2988	powershell.exe
Token: 36	2988	powershell.exe
Token: SeIncreaseQuotaPrivilege	2988	powershell.exe
Token: SeSecurityPrivilege	2988	powershell.exe
Token: SeTakeOwnershipPrivilege	2988	powershell.exe
Token: SeLoadDriverPrivilege	2988	powershell.exe
Token: SeSystemProfilePrivilege	2988	powershell.exe
Token: SeSystemtimePrivilege	2988	powershell.exe
Token: SeProfSingleProcessPrivilege	2988	powershell.exe
Token: SeIncBasePriorityPrivilege	2988	powershell.exe
Token: SeCreatePagefilePrivilege	2988	powershell.exe
Token: SeBackupPrivilege	2988	powershell.exe
Token: SeRestorePrivilege	2988	powershell.exe
Token: SeShutdownPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeSystemEnvironmentPrivilege	2988	powershell.exe
Token: SeRemoteShutdownPrivilege	2988	powershell.exe
Token: SeUndockPrivilege	2988	powershell.exe
Token: SeManageVolumePrivilege	2988	powershell.exe
Token: 33	2988	powershell.exe
Token: 34	2988	powershell.exe
Token: 35	2988	powershell.exe
Token: 36	2988	powershell.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4000	Spotify.exe
4000	Spotify.exe
4000	Spotify.exe
4000	Spotify.exe
4000	Spotify.exe
4000	Spotify.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4000	Spotify.exe
4000	Spotify.exe
4000	Spotify.exe
4000	Spotify.exe
4000	Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2988	2304	cmd.exe	88
PID 2304 wrote to memory of 2988	2304	cmd.exe	88
PID 1288 wrote to memory of 1904	1288	powershell.exe	107
PID 1288 wrote to memory of 1904	1288	powershell.exe	107
PID 2988 wrote to memory of 4000	2988	powershell.exe	110
PID 2988 wrote to memory of 4000	2988	powershell.exe	110
PID 4000 wrote to memory of 768	4000	Spotify.exe	111
PID 4000 wrote to memory of 768	4000	Spotify.exe	111
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 4660	4000	Spotify.exe	112
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116
PID 4000 wrote to memory of 3416	4000	Spotify.exe	116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BlockTheSpot.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& {[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -UseBasicParsing 'https://raw.githubusercontent.com/mrpond/BlockTheSpot/master/install.ps1' | Invoke-Expression}"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.43.420 --initial-client-data=0x3a0,0x3a4,0x3a8,0x39c,0x3ac,0x7ffce492aef0,0x7ffce492aefc,0x7ffce492af08
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:768
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1696,i,7421327839931037462,777408286539134684,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4660
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3284,i,7421327839931037462,777408286539134684,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3416
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3412,i,7421327839931037462,777408286539134684,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1056
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/125.0.6422.112 Spotify/1.2.43.420" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3996,i,7421327839931037462,777408286539134684,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoLogo -NoProfile -Command & 'C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-08-10_14-29-50\SpotifyFullSetup.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-08-10_14-29-50\SpotifyFullSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-08-10_14-29-50\SpotifyFullSetup.exe"
  2⤵
  PID:1904
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
2KB

MD5
73c44bf55b361bb78589ca099b4c5d7b

SHA1
34dd91589afc3bb9f6bd63203bda6ec57b757fe3

SHA256
512c968d86d63516286966534a142ee133524530e8382f74a43dc93bc2ad378a

SHA512
f45685b8d5362b5efbbd8de7fe4321d4c33f7bdf38e51bca1169caaa7d3838a83205abf0a35c5a3eba5a3e666d94cd27722d2821a8a1ee8e7d09a0e058872ba4

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
ce0761bd759297f3a15c39790c0546bd

SHA1
db8ac4369a76e42a32f2b3783dba36256d6557bc

SHA256
0ef9acf3961b9f0c828ef3953948f43722160fd1340b0ee91a130b9072031eec

SHA512
563e47dbb99775a95a4bb4ec60742a919bbc9dc0e5770dc75c4e1e71a346b2e4747d3979a4a9b6dd0801e1166b57aabace5757d56e7e37558845cf668748ddae

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
6ec3d1e1df4bc84bc2b2ae90c5003082

SHA1
2c9d2c60fbebd0753a1bc4242edcbcfaf50fc425

SHA256
12bd2d3fb2aad57baa3e3addff79b74190d68a15ff43a6c08ecbc1c8da9cfc3f

SHA512
bd14262c867b6cbefb00f52500c6cb63ca173613c336a0bd836c502af5e4a3a5ebff332e3f1920c7e2c5be9e15065d08e22e5f4eed37f3e5b61225b16a687926

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
1e8b9daa885f2821fa25de70028a127a

SHA1
1cb8ece148b21d0f175ca2bac4a63376f40fb3b1

SHA256
d35951ad8cbd44acb12503fa405d79e3fc1466b23c04545e96229c392300092d

SHA512
5465c93eb2c135cc46bbea3e311b21290a9dde4b65b2fdd8fc1a9fbff2f3b7b7bc0b39cb0e26b40d412e12d09601c8090a547317f46c6ce12e620a63ce58cea6

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-08-10_14-29-50\config.ini

Filesize
101B

MD5
72d74873a9d7f5905ffe33abbb83ce5c

SHA1
bde774f7a4e2e0320a80e8b6bcfd3f1d496fd966

SHA256
45c2bc29abefa7af80b4ae0bb3e67feb1c2ab2e54922915839099cc6fcf78b43

SHA512
ce7fc7b3c39300fb8e7a438ecc21849e4f62055baace0e0c3f44db8fde905f057dd48c7cc41b28234e38154cb9a54d9d4c81c9fd5afb3a0e9964b5685867986b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1it3yuz0.auc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
3.5MB

MD5
5c287b41538166fc2e012916fe49a6a2

SHA1
98b56ee955e15f5d5e619ed4fe47c7dbb2769a9d

SHA256
2bda601b183fe79a4e8f0d7aaf8f19089978f4626660f984a2a43298e1ee559b

SHA512
eb82b4e9d835d704e320f07420dbfe4132ba8848c31f6623fd0cb803f13885ad5ecd741b2d21a41b1a624758130276e1704cb8f8e6c1ab7fd0b85d21916eaa34

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
33.7MB

MD5
af33eb83fbf45abc1b55c9ee9a53290f

SHA1
2288e2f78a26ff4f3ba2c3d8632328eef260919e

SHA256
e9553b44a5fce164fa475d42cb28aeacdf3c59e0e2a1d1b00804d5b72a8b29bf

SHA512
e0df560215c5bc7b118766a03f8b9720d0acdb46295ba664a04aabf6dc3d16a145f2d44f549694b6ad0b6d160e311912404601d88011ef0d28d60735d6d15590

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
667KB

MD5
6c66dfb43b302bb2f59bdb0941fee3f0

SHA1
d150584a60b362d292d52b52b0ce0e81d3835d3b

SHA256
adebb2921cc84e02bbf9417a16ebe18d84938fd27475b517b36a0da9da505ac1

SHA512
f07b6c9008e4dc0e8aaa6b95a4d2b1a1fb437a8d646a973fc7b98f7bfac42df7a50bd83767daf9959976e720eb7dc9eb256838e1dda36c1700de9f1aea07390b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
744ecf3e5f1b18e950533e0d42e6d4ad

SHA1
bb9a9ee40649a3f5bd2e7f46e16c7e5e139b7e54

SHA256
a3cf8aa391aad9d995670099cda3ec390956cd6eb97ac90ecd1d259ba466486e

SHA512
189bfe2a3e5e5a2fdc46128745244c68a7a86fa9bc3af48753e9efdbc229ec3b01c800ee285713656ee93e51a9c4a0a13bf52bdbf818994624929938661d5323

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.3MB

MD5
0d9fed30817d3a0271b96f26f4d114e6

SHA1
bac667c772e048dbb14203e1eb423cb0c67753a1

SHA256
1fb7f376e75cb07dea3585d3594473648d2eb637d5bd2db9c23f87f1274e963c

SHA512
10124d6f07c8974a70f05fb72193e7a2935e73d70de383ed9552f29de638e814627649c04bb2923c7e8275d5671d7d03ab3c492e9f72f405b9460532cf8e583c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
656B

MD5
424698b0b65b8efe880c3febb4e14f32

SHA1
e2edf49c6b5b7cfebd33b992df1551b6da931653

SHA256
b4e1deee4d7280b407ac62946f7ec1c507b2a2973f8e026abe11ac42aada6081

SHA512
aacbd0d29d245a8642d0509c7c1a0f79d082ff4fda6d5d5fe8af00962ab9f379dd90f70550d7eec779e99ff375eda619864f9432a922c2a574803639d84b181d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
4.7MB

MD5
8bcf583884578e1d06fa23a7d9edd6f4

SHA1
41a95c4554c1cf6f95d8160376713b34850905cb

SHA256
7322271eded814d5975bc59d673cf48361ff2a1810c1737a67ccf93f16998622

SHA512
921e13e9ce4c4992d82dfcd6ec83eea2cdaeb3e46f4594c3115f2c3358141de7d8ddb0abab32002c984dd83c53291d1a719626ebb98263372dcebbf68296e9ad

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\dpapi.dll

Filesize
842KB

MD5
304d94e5b265e29e87a5f38ece1a3630

SHA1
7bf6409cf69d969319ad5cba5fa47695c91ab2bb

SHA256
9dceedac8397d8673c9588c638fa74581f3a5c5ad46867b5976fc487769b977b

SHA512
ba0306c15792f2278dc88e8b1d1b125ddbdd6a7826f75cd1d79a69d913c9d6e022d0255ab9dc13331185f126c82e60d58e74cc637fbbbbcbb6808e37de734ab1

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
467KB

MD5
5376ee7b1dc29b374481cc8cc6d8a808

SHA1
54cce8eb81a636754655045c03f14c6b0de162dd

SHA256
534d610c3420147060feffeb03d1033207936debb4e192db504cccff73ee678f

SHA512
5ac210622860ff401641f9b2883ec5c7b71efbd1763a6c9e0b8380cb7af0379ad99c6bd05a85f14aefb11c02c9496445c762a88df303f32b94fbe8865a347c2a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
7.7MB

MD5
609245170021cbe9f2307f4364222f16

SHA1
f4b39328904b0f91d0ad95990d46f9713f175e1b

SHA256
1f095076ba3900ff5420e0e586e1e892aa7b8c38adada16580a8596648fbf17b

SHA512
39791a923a51660025f9b99900a193e2682557f632a719ab2ccb1241f6d007a7e9341f904540be5e766bd2fa5e4847a794aac5985e7021826b9ef2352919879d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
459KB

MD5
d74fa66466d377a2e5ea85c7142895d6

SHA1
4976fa62b0fc60a92c4a84d7e4b1ab939ed7bfbb

SHA256
dd2c824c1b8365c730fb91ae90f90d0e1115f444d36fd90097b2544e24822205

SHA512
7010936923a8414ebff0197b647a387729f86e6e0fd5166726fed0c9410fcb7644fd3632aa4fe492428efff2e451119fc86e0f85df8a0a93ef071db1800df623

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
2cfe980c0024751358360372fe4bc2b1

SHA1
4d926cf61c0e9d27ff847fc3446f049dbd1da192

SHA256
3905cd0af0025adc86548e2f47d68461408a2e2800d66669c9fdf7829c53dee1

SHA512
8bc0f5ee1ded4c693f0e239fdc308626da2d32cf86997d93e000d8c5bd89e42d77a3e058fe548e6f4aeeb5d1e9391f308071bad6b55212500d9dd7cc1bacc6e3

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.1MB

MD5
5d169d0b80ebd3c7d3fc517d9e13f007

SHA1
ab43a52fbbb3994f4c3a90688b14592353701f9b

SHA256
8aa4a2089231bd8262e988b10d2cb0428a38fa3c6c28f90d00c4437e83cc6d3e

SHA512
e39e0616ea3b904b2f0c512eb5c551aebe407a95baecaa73fa484211c347f128506c305986b26634d4fe3b4339f05251594a8ae2b167f65378aa7674edb5fab8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
652KB

MD5
d7acfe5407bfc156b1dd134670eb8734

SHA1
abcd7e124e5c4525f2888d4346b4e029f31fa77d

SHA256
5c338e3e42c376f230e9764cbd97e1b4befae13d82ebd04318b5e42c94ff278f

SHA512
9c1a1381e41a488924f3b7f5aa8dbef6f1a82c5a7eb6c958c0a0aea9ca2dea08ad3690b5d38bd2663108e8c58e687d3da090023b2ac8bdda92552d1c6aee171c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
5.0MB

MD5
57f9a132265935e4099d5319cc86349d

SHA1
9a760ab2dbff73d8897b43609190f05061b54f81

SHA256
f2851e5732eea560b488d2e3ba2078ac26e7599d84e979a4d597576c590e2345

SHA512
11760974aeeee12eaca2666ddb59674d3e084ed0643c9064215a009db749c73577b8abadf62482c62f5cca216eff46f840788697e647b1454079b074a8fb3ebc

Download Submit
memory/1288-38-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/1288-23-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/1288-33-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/1288-35-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/2988-18-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/2988-17-0x00000149C0A40000-0x00000149C0A66000-memory.dmp

Filesize
152KB

Download
memory/2988-1-0x00000149A7640000-0x00000149A7662000-memory.dmp

Filesize
136KB

Download
memory/2988-34-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/2988-235-0x00000149C1000000-0x00000149C1012000-memory.dmp

Filesize
72KB

Download
memory/2988-11-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/2988-12-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/2988-236-0x00000149C0FE0000-0x00000149C0FEA000-memory.dmp

Filesize
40KB

Download
memory/2988-22-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/2988-21-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/2988-20-0x00007FFCF0573000-0x00007FFCF0575000-memory.dmp

Filesize
8KB

Download
memory/2988-19-0x00000149C0AD0000-0x00000149C0AE4000-memory.dmp

Filesize
80KB

Download
memory/2988-0-0x00007FFCF0573000-0x00007FFCF0575000-memory.dmp

Filesize
8KB

Download
memory/2988-13-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/2988-14-0x00000149C07E0000-0x00000149C07F6000-memory.dmp

Filesize
88KB

Download
memory/2988-39-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/2988-255-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

Filesize
10.8MB

Download
memory/2988-16-0x00000149C0A70000-0x00000149C0A96000-memory.dmp

Filesize
152KB

Download
memory/2988-15-0x00000149A7BB0000-0x00000149A7BBA000-memory.dmp

Filesize
40KB

Download
memory/3416-525-0x0000015C6C5E0000-0x0000015C6CD1F000-memory.dmp

Filesize
7.2MB

Download
memory/3416-526-0x0000015C6CD20000-0x0000015C6CDCC000-memory.dmp

Filesize
688KB

Download
memory/3416-332-0x00007FFD0D830000-0x00007FFD0D831000-memory.dmp

Filesize
4KB

Download
memory/3416-331-0x00007FFD0D5B0000-0x00007FFD0D5B1000-memory.dmp

Filesize
4KB

Download
memory/3780-461-0x0000016E2C670000-0x0000016E2CDAF000-memory.dmp

Filesize
7.2MB

Download
memory/3780-524-0x0000016E2CDB0000-0x0000016E2CE5C000-memory.dmp

Filesize
688KB

Download
memory/3860-234-0x00007FF7AFB60000-0x00007FF7B1D54000-memory.dmp

Filesize
34.0MB

Download
memory/4000-278-0x00007FFC8E220000-0x00007FFC8E230000-memory.dmp

Filesize
64KB

Download
memory/4000-279-0x00007FFC8E220000-0x00007FFC8E230000-memory.dmp

Filesize
64KB

Download
memory/4000-369-0x00007FFC8E220000-0x00007FFC8E230000-memory.dmp

Filesize
64KB

Download
memory/4000-256-0x00007FF7AFB60000-0x00007FF7B1D54000-memory.dmp

Filesize
34.0MB

Download
memory/4000-370-0x00007FFC8E220000-0x00007FFC8E230000-memory.dmp

Filesize
64KB

Download
memory/4000-528-0x00007FF7AFB60000-0x00007FF7B1D54000-memory.dmp

Filesize
34.0MB

Download