cryptolocker | 8b78d1071a5c9add21685f9607f42010ef8c04fd4a789a45fe8678fde6ab1d24

Analysis

max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlockTheSpot.bat
Size

265B
MD5

d2a6bb7593c8c2c054a65c6d2167197a
SHA1

721bc41054dfbdac908e11881e5c1885002a8183
SHA256

8b78d1071a5c9add21685f9607f42010ef8c04fd4a789a45fe8678fde6ab1d24
SHA512

48fbc3ef45ec6b1fe3fd6a6d832739308bcf84c4bd7fa83b7295e054a29dda15cc0b70d93ef43906c3c9fb4194e66eab02eb8863d2a1a5646c18d7b3a52984ca

Score

10^/10

cryptolocker discovery execution persistence ransomware

Malware Config

Signatures

CryptoLocker
Ransomware family with multiple variants.
ransomware cryptolocker

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2996	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2996	powershell.exe
2684	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 32 IoCs

pid	Process
1300	Spotify.exe
4820	Spotify.exe
4312	Spotify.exe
3648	Spotify.exe
2340	Spotify.exe
2016	Spotify.exe
4912	Spotify.exe
392	Spotify.exe
5204	CryptoLocker (3).exe
528	{34184A33-0407-212E-3320-09040709E2C2}.exe
4076	{34184A33-0407-212E-3320-09040709E2C2}.exe
1472	CryptoLocker (4).exe
5416	CryptoLocker (4).exe
5676	CryptoLocker (4).exe
5340	Spotify.exe
3812	CryptoLocker (4).exe
5856	CryptoLocker (4).exe
2620	CryptoLocker (4).exe
5696	CryptoLocker (4).exe
4192	CryptoLocker (4).exe
1256	CryptoLocker (4).exe
5128	CryptoLocker (4).exe
4432	CryptoLocker (4).exe
1060	CryptoLocker (4).exe
6020	CryptoLocker (4).exe
5324	CryptoLocker (4).exe
3924	CryptoLocker (4).exe
5416	CryptoLocker (4).exe
5712	CryptoLocker (4).exe
4200	CryptoLocker (4).exe
5624	CryptoLocker (4).exe
3008	CryptoLocker (4).exe

Loads dropped DLL 29 IoCs

pid	Process
4820	Spotify.exe
4820	Spotify.exe
4820	Spotify.exe
4312	Spotify.exe
4312	Spotify.exe
4312	Spotify.exe
3648	Spotify.exe
3648	Spotify.exe
3648	Spotify.exe
3648	Spotify.exe
3648	Spotify.exe
3648	Spotify.exe
3648	Spotify.exe
2016	Spotify.exe
2016	Spotify.exe
2016	Spotify.exe
2340	Spotify.exe
2340	Spotify.exe
2340	Spotify.exe
4912	Spotify.exe
4912	Spotify.exe
4912	Spotify.exe
392	Spotify.exe
392	Spotify.exe
392	Spotify.exe
5340	Spotify.exe
5340	Spotify.exe
5340	Spotify.exe
5340	Spotify.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CryptoLocker = "C:\\Users\\Admin\\AppData\\Roaming\\{34184A33-0407-212E-3320-09040709E2C2}.exe"	{34184A33-0407-212E-3320-09040709E2C2}.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com
186	raw.githubusercontent.com
187	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4820_365186332\_platform_specific\win_x64\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4820_365186332\_platform_specific\win_x64\widevinecdm.dll	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4820_365186332\LICENSE	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4820_365186332\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4820_365186332\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4820_365186332\manifest.fingerprint	Spotify.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (3).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{34184A33-0407-212E-3320-09040709E2C2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoLocker (4).exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-523280732-2327480845-3730041215-1000\{B6463025-4744-4E05-BEBF-90C93E0A1409}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe

NTFS ADS 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 429489.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 703976.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 337383.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe\:SmartScreen:$DATA	CryptoLocker (3).exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 785361.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 342544.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2684	powershell.exe
2684	powershell.exe
2684	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
2996	powershell.exe
4892	msedge.exe
4892	msedge.exe
2704	msedge.exe
2704	msedge.exe
5796	msedge.exe
5796	msedge.exe
6024	identity_helper.exe
6024	identity_helper.exe
5456	msedge.exe
5456	msedge.exe
5904	msedge.exe
5904	msedge.exe
5340	Spotify.exe
5340	Spotify.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeIncreaseQuotaPrivilege	2996	powershell.exe
Token: SeSecurityPrivilege	2996	powershell.exe
Token: SeTakeOwnershipPrivilege	2996	powershell.exe
Token: SeLoadDriverPrivilege	2996	powershell.exe
Token: SeSystemProfilePrivilege	2996	powershell.exe
Token: SeSystemtimePrivilege	2996	powershell.exe
Token: SeProfSingleProcessPrivilege	2996	powershell.exe
Token: SeIncBasePriorityPrivilege	2996	powershell.exe
Token: SeCreatePagefilePrivilege	2996	powershell.exe
Token: SeBackupPrivilege	2996	powershell.exe
Token: SeRestorePrivilege	2996	powershell.exe
Token: SeShutdownPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeSystemEnvironmentPrivilege	2996	powershell.exe
Token: SeRemoteShutdownPrivilege	2996	powershell.exe
Token: SeUndockPrivilege	2996	powershell.exe
Token: SeManageVolumePrivilege	2996	powershell.exe
Token: 33	2996	powershell.exe
Token: 34	2996	powershell.exe
Token: 35	2996	powershell.exe
Token: 36	2996	powershell.exe
Token: SeIncreaseQuotaPrivilege	2996	powershell.exe
Token: SeSecurityPrivilege	2996	powershell.exe
Token: SeTakeOwnershipPrivilege	2996	powershell.exe
Token: SeLoadDriverPrivilege	2996	powershell.exe
Token: SeSystemProfilePrivilege	2996	powershell.exe
Token: SeSystemtimePrivilege	2996	powershell.exe
Token: SeProfSingleProcessPrivilege	2996	powershell.exe
Token: SeIncBasePriorityPrivilege	2996	powershell.exe
Token: SeCreatePagefilePrivilege	2996	powershell.exe
Token: SeBackupPrivilege	2996	powershell.exe
Token: SeRestorePrivilege	2996	powershell.exe
Token: SeShutdownPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeSystemEnvironmentPrivilege	2996	powershell.exe
Token: SeRemoteShutdownPrivilege	2996	powershell.exe
Token: SeUndockPrivilege	2996	powershell.exe
Token: SeManageVolumePrivilege	2996	powershell.exe
Token: 33	2996	powershell.exe
Token: 34	2996	powershell.exe
Token: 35	2996	powershell.exe
Token: 36	2996	powershell.exe
Token: SeIncreaseQuotaPrivilege	2996	powershell.exe
Token: SeSecurityPrivilege	2996	powershell.exe
Token: SeTakeOwnershipPrivilege	2996	powershell.exe
Token: SeLoadDriverPrivilege	2996	powershell.exe
Token: SeSystemProfilePrivilege	2996	powershell.exe
Token: SeSystemtimePrivilege	2996	powershell.exe
Token: SeProfSingleProcessPrivilege	2996	powershell.exe
Token: SeIncBasePriorityPrivilege	2996	powershell.exe
Token: SeCreatePagefilePrivilege	2996	powershell.exe
Token: SeBackupPrivilege	2996	powershell.exe
Token: SeRestorePrivilege	2996	powershell.exe
Token: SeShutdownPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeSystemEnvironmentPrivilege	2996	powershell.exe
Token: SeRemoteShutdownPrivilege	2996	powershell.exe
Token: SeUndockPrivilege	2996	powershell.exe
Token: SeManageVolumePrivilege	2996	powershell.exe
Token: 33	2996	powershell.exe
Token: 34	2996	powershell.exe
Token: 35	2996	powershell.exe
Token: 36	2996	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3884	SpotifyFullSetup.exe
3884	SpotifyFullSetup.exe
4820	Spotify.exe
4820	Spotify.exe
4820	Spotify.exe
4820	Spotify.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4820	Spotify.exe
4820	Spotify.exe
4820	Spotify.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2996	2380	cmd.exe	84
PID 2380 wrote to memory of 2996	2380	cmd.exe	84
PID 2684 wrote to memory of 3884	2684	powershell.exe	100
PID 2684 wrote to memory of 3884	2684	powershell.exe	100
PID 2996 wrote to memory of 4820	2996	powershell.exe	103
PID 2996 wrote to memory of 4820	2996	powershell.exe	103
PID 4820 wrote to memory of 4312	4820	Spotify.exe	104
PID 4820 wrote to memory of 4312	4820	Spotify.exe	104
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 3648	4820	Spotify.exe	106
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107
PID 4820 wrote to memory of 2340	4820	Spotify.exe	107

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BlockTheSpot.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "& {[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -UseBasicParsing 'https://raw.githubusercontent.com/mrpond/BlockTheSpot/master/install.ps1' | Invoke-Expression}"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.45.454 --initial-client-data=0x3b0,0x3b4,0x3b8,0x3ac,0x3bc,0x7ff8800baa60,0x7ff8800baa6c,0x7ff8800baa78
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4312
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1680,i,12090116270923840548,946225297888012106,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3648
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3276,i,12090116270923840548,946225297888012106,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2340
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3616,i,12090116270923840548,946225297888012106,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2016
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3780,i,12090116270923840548,946225297888012106,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.spotify.com/login?continue=https%3A%2F%2Faccounts.spotify.com%2Foauth2%2Fv2%2Fauth%3Fclient_id%3D65b708073fc0480ea92a077233ca87bd%26response_type%3Dcode%26redirect_uri%3Dhttp%253A%252F%252F127.0.0.1%253A4381%252Flogin%26scope%3Dapp-remote-control%252Cplaylist-modify%252Cplaylist-modify-private%252Cplaylist-modify-public%252Cplaylist-read%252Cplaylist-read-collaborative%252Cplaylist-read-private%252Cstreaming%252Cugc-image-upload%252Cuser-follow-modify%252Cuser-follow-read%252Cuser-library-modify%252Cuser-library-read%252Cuser-modify%252Cuser-modify-playback-state%252Cuser-modify-private%252Cuser-personalized%252Cuser-read-birthdate%252Cuser-read-currently-playing%252Cuser-read-email%252Cuser-read-play-history%252Cuser-read-playback-position%252Cuser-read-playback-state%252Cuser-read-private%252Cuser-read-recently-played%252Cuser-top-read%26code_challenge%3DJ3aETefdWSLGV3h4XjZsQ4Y0wlwQ98U9ld-xrQsf51g%26code_challenge_method%3DS256&method=login-accounts&creation_flow=desktop&creation_point=https%3A%2F%2Flogin.app.spotify.com%2F%3Fclient_id%3D65b708073fc0480ea92a077233ca87bd%26utm_source%3Dspotify%26utm_medium%3Ddesktop-win32%26utm_campaign%3Dorganic&flow_ctx=3aa37d90-e5d1-4206-bc22-93f8bc1f3e11%3A1725263853&utm_source=spotify&utm_medium=desktop-win32&utm_campaign=organic
      4⤵
      Enumerates system info in registry
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8889746f8,0x7ff888974708,0x7ff888974718
        5⤵
        
        PID:4244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        5⤵
        
        PID:628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
        5⤵
        
        PID:1112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
        5⤵
        
        PID:3296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
        5⤵
        
        PID:2932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
        5⤵
        
        PID:5692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
        5⤵
        
        PID:5784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
        5⤵
        
        PID:5792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
        5⤵
        
        PID:6032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
        5⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
        5⤵
        
        PID:5556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5012 /prefetch:8
        5⤵
        
        PID:5836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5216 /prefetch:8
        5⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:5796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
        5⤵
        
        PID:2832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
        5⤵
        
        PID:5308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
        5⤵
        
        PID:6064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
        5⤵
        
        PID:2068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
        5⤵
        
        PID:5860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
        5⤵
        
        PID:4072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
        5⤵
        
        PID:2344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
        5⤵
        
        PID:5752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5684 /prefetch:8
        5⤵
        
        PID:3104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6812 /prefetch:8
        5⤵
        
        PID:5736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6980 /prefetch:8
        5⤵
        
        PID:2688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
        5⤵
        
        PID:3920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
        5⤵
        
        PID:5456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
        5⤵
        
        PID:5980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
        5⤵
        
        PID:5224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
        5⤵
        
        PID:3680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
        5⤵
        
        PID:5768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7548 /prefetch:8
        5⤵
        
        PID:5684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6500 /prefetch:8
        5⤵
        
        PID:2212
    - - C:\Users\Admin\Downloads\CryptoLocker (3).exe
        
        "C:\Users\Admin\Downloads\CryptoLocker (3).exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        NTFS ADS
        
        PID:5204
      - C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
        
        "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\Downloads\CryptoLocker (3).exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:528
        
        C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe
        
        "C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w0000021C
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4930409772485641555,12795107280702411466,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7304 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5420
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=4736,i,12090116270923840548,946225297888012106,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:392
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5084,i,12090116270923840548,946225297888012106,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoLogo -NoProfile -Command & 'C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-09-02_01-56-43\SpotifyFullSetup.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-09-02_01-56-43\SpotifyFullSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-09-02_01-56-43\SpotifyFullSetup.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:3884
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    PID:1300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5200

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2996

C:\Users\Admin\Downloads\CryptoLocker (4).exe
"C:\Users\Admin\Downloads\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1472

C:\Users\Admin\Downloads\CryptoLocker (4).exe
"C:\Users\Admin\Downloads\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5416

C:\Users\Admin\Downloads\CryptoLocker (4).exe
"C:\Users\Admin\Downloads\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5676

C:\Users\Admin\Downloads\CryptoLocker (4).exe
"C:\Users\Admin\Downloads\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3812

C:\Users\Admin\Downloads\CryptoLocker (4).exe
"C:\Users\Admin\Downloads\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5856

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2620

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5696

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4192

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1256

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5128

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4432

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1060

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6020

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5324

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3924

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5416

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5712

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4200

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5624

C:\Users\Admin\Desktop\CryptoLocker (4).exe
"C:\Users\Admin\Desktop\CryptoLocker (4).exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4820_365186332\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4820_365186332\manifest.json

Filesize
1001B

MD5
2648d437c53db54b3ebd00e64852687e

SHA1
66cfe157f4c8e17bfda15325abfef40ec6d49608

SHA256
68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806

SHA512
86d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
67KB

MD5
ed124bdf39bbd5902bd2529a0a4114ea

SHA1
b7dd9d364099ccd4e09fd45f4180d38df6590524

SHA256
48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44

SHA512
c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
41KB

MD5
f3d0a156d6ecb39d1805d60a28c8501d

SHA1
d26dd641e0b9d7c52b19bc9e89b53b291fb1915c

SHA256
e8be4436fcedf9737ea35d21ec0dcc36c30a1f41e02b3d40aa0bfa2be223a4a3

SHA512
076acfd19e4a43538f347ab460aa0b340a2b60d33f8be5f9b0ef939ef4e9f365277c4ff886d62b7edb20a299aacf50976321f9f90baba8ccd97bc5ac24a580bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
38KB

MD5
bff21faca239119a0a3b3cf74ea079c6

SHA1
60a40c7e60425efe81e08f44731e42b4914e8ddf

SHA256
8ea48b2ac756062818bd4ee2d289b88d0d62dc42a36cb6eee5bdd2ff347816c7

SHA512
f9e5baefacae0cdb7b9c93afc43ad6ec3902b28c0cdf569e1a7013f4e5c8dfb7b389b5e2bc724b4ddfe554437320f4f2cc648642944c6f48ad2a78815acd9658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
1.2MB

MD5
540af416cc54fd550dcdd8d00b632572

SHA1
644a9d1dfcf928c1e4ed007cd50c2f480a8b7528

SHA256
e4e53d750c57e4d92ab9de185bb37f5d2cc5c4fcc6a2be97386af78082115cbb

SHA512
7692e046e49fcde9c29c7d6ea06ed4f16216ec9fb7ea621d3cc4493364743c03925e74244785588d1a4bfc2bedd32b41e7e66e244990d4076e781d7f4bbb270f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5d46d50ffe9b3d6f58448fc2a9178de5

SHA1
0bccb700bcfe2f2d5b5f41138297a1d0d2d7f0eb

SHA256
54a5fa55a154ad1eb08b98d0ed7315dfe8a2141e2c1f93d626ed503d483c4de9

SHA512
2739ccf283b485f7bcc8a0fe4d015093f19f13992d75d66059d73d5710de0944ca72113cf24add86296bcb0cbbde2e27cc91e884d7a2447b5a0e554124f1be69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
633891c2120d90ca4055d5307f3addec

SHA1
c8ed45b2f386ff99e91f77a06bafc9bd7d791dc1

SHA256
9a23010f6e0eef34309a2329abe88a9638db485ce1927afda853d3d9d466f873

SHA512
23a9a9f74c7f782b616c53a5da8228e575d0f11027b64dc7299c194c61487b3c1cd309096994c548f62d71cae2bd4553f16aa6d2d6be34a0fd1c60ac2092976f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ef8b2a7d262d97fd7020062fbcfbd390

SHA1
696991056baaf3844431cbd1ed227edcc73e8226

SHA256
0bbe4ed3f8719fd07ea239acd8f8bbe2ec8a0eaa3d349a753dde620e7e669bc4

SHA512
cf4449ad213e1932821d770e4aa82776e2d5c429a2b4704c84b036a3369adf1f2880a4970f14a62645c4245773462ceedd07169ce9384791bcc58e9c3a8ac49e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b75a625a46e36a2f716a65a260091d40

SHA1
01b8b52592750c13d85a14840c2fa723902e4f4d

SHA256
0c1711751ac9ebadb4b11716f61ff5d743c3b8894dbef7ce8818183c1ac1c674

SHA512
23d0ce85d78e5ddde907e873369ba62fd331dc59e91f17f6ab1ed2c814accdf544bac4019119f429b2ccf1b6b5f24494b502c31ecb428d0b501cad4f4f9cf8d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
95a16e77bcbbc5fa4dbd66efef55434d

SHA1
5b3a1970e3793c767df4a56b89c4256ce5988588

SHA256
f248de77eacea0cb6f797ce2805085c5c96f85026dc2db85f360ace2ae097a76

SHA512
e559d713c37b6efffdc2d76decfd3e01e74970ee7ee8d328d2ecaadb49950400103034d192b22cd31cae44f1ef40b57da92a9e93f54dda2ea3c6a579ca314406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0e3647ef1063171332194026b74844e6

SHA1
0fe62949e96c105e967904763b08dc581ef197c3

SHA256
ca4107e68e6ab295cbbdbbfc255db2bfff0e7b04f9778bb463ed83d128d67248

SHA512
c218b650fed0faaa73d493b0731cea1959e613c2425cbc6b081bd1d73e89df7bc030e8604071a7bda5fb3487ecc5f2787bb40418f669aa053f1a5f73e9a298d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e6bc2cf5a8223b3138374014615bdd30

SHA1
9199c7f4dcf14a44f928e390619e5530fba8a07e

SHA256
18470ff8aa5ec553ebf714e2c10bda5b944b90d512ada1317e3af69fcca39e30

SHA512
eeab40943b12281dffa15983b0ddf40e315a26246bf5de2e678182494b0cef8bdd3c9b82ab84d7e3fecb56cadcc880a40f07121d5829584281fe8365808073fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9a24aa807ce2aa9250b347b00419cb6d

SHA1
128b93bf506b0a4ec381775769700e2d51b48844

SHA256
563076cbf6cbb2f5ece0dcabfb9c31b386b8de973201969f47d480aae65c5ec0

SHA512
cbe5588cf84b4dca2f1004b32577d0c66f21a2ce988014abbcc276077986fe078e43e910a131094bd3801a8e1451a13c7eab3b87187ceffb93aebf8efcf137b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ab08eedc7195c3577c707dc37acf0a61

SHA1
104c8a168ca977112be33da66f23071ede87f7e8

SHA256
6f1a3293984f122c5a7be7b8b8c0360652d4e7f185806f46efa5347be2cf3052

SHA512
a8d623e3a0d739379e7d1a096d0c910d8369c6551ba4a13e4872f92fd0c2daff3d3ed30d5cbef73e1cbfc4bbbc377981192308537446f2fd5cf2916fd3c484cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7031ff6dbf191a38593a7f04a44344c5

SHA1
a179ddc9b35e2a394928e8880d1a62b3a8854119

SHA256
2b58aba14ad20a6a900eac8192aef8821ccbfd32843ece369cadb9071c7e9e8a

SHA512
379648e1e7ea4a010d88d77bb8a752dd6eb6b5d0a356551e7dff743fff9456e074c0df3beea3e6f93be9096e160654ada880ac11f9692cc5dad13eb753521be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6515f80658b213aed006d477fe769933

SHA1
838b95cdc31d7c9f9cb2c84d3e2e528602ba8204

SHA256
c8c4e99cbd5da9e9ef93814f56818865a81407805f1bcba6d96ff0b540d606db

SHA512
1ab974d31ec6f83aa0b1ef4d81993bb1358b6293e7e07dbe19f0b7bad531c9e48ec971bbe01d59dec37c94a5d156eb2430083cc670e515961a102be981526873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0637b75d2fe2beda1f8fa5ec9d17e366

SHA1
464f6c3ebe2bbf1091c28a14971930a8b8e6b9b7

SHA256
612eed84f14577ccd3a3065b2f8f155af0a5a352f3f1374d190990fb6ae727da

SHA512
f7d4fcbe8d70383362b6efce0bd66a97034adca03988071657b7183e6339e4f08db504fe1d1e89f059fdecaaffe2a97a017da3a80078940ff58d0298275a7e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d02d57aef3439c6ce1ec71fd08c47bee

SHA1
ebb931095a8d4066ba6fb80427ee75073cd143a5

SHA256
8bc8ff5bef22dbf61a0f2e6958856004372627f014dfe00f1fadfcda0d7aa2e5

SHA512
27c981ecec01c2421f9fc7e2dab13c4409c920597c59370d68b0af30305adf58719d48faeb9d679202e348bd789118e221ebd1b0640e5f2427e4deaecf23d47b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
345d91c8d83004f3b914fb9b3d7d28aa

SHA1
a724eeef509b62c88019fab2df88af06c760cc79

SHA256
493e3b9d6a1de16612f3c55637e7b1fc946a3119aa710290f89b506f318649ff

SHA512
937b1c67fd884549ec50596a3e5c39dee4d2fdb72a31b9d80ee54b9071dd8bdcde4c95ba5857a156024d2505dd174da64723d7b402e0056d4b405b259c3649c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4b5ec0a4c8517b7c0184711821b2a1ff

SHA1
7a5c55e623f83ea0925a90cc25fb95c9a2b25130

SHA256
7b2734107b06724c826ff0a58e21b19d56ab647a8ce53334a9a5649a43140fca

SHA512
24c89a12410c4d562c1f54041f4e7f2ac7c25a06d32ece2a1b9559d876a81933280062adcbdc82af0b3c0c10064c0aee8647bfa055634d96c5796c515ec595f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7ede839b7bbb67a40aca14252e890df5

SHA1
cf12b95136568e2b3b2ab48423223c27e6a5e620

SHA256
bae98f4214cd026d5f1828ebfeb230ef8543489636b9699bdcec3227d43372ca

SHA512
de7c73afb6999f6f973b0ad4533177c241547e686bbb08679596455e1a3b8d82e5a5b9056aa3454e8697f0b245757a1235f7e5155c09eb4ea5fe9c932830b3fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
75bd8fa97f8aa2eca636a8f0b95d5d99

SHA1
5a661eb87c16bb974b9c8a5479032cdb1207a5fa

SHA256
6d2450aeb432e1f4b9674e2504f4212a8a4dc8a360812fc04704cf27ee20f524

SHA512
9392e8a3ddcb65b48f1a331fbaf6f077713123b7f130f1251a215bd418ad8e1748aeaad48e46b2cfb77d024608d730bf220fa0296e263371267bfdc0026f024a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3ebe308-dd9b-4066-b849-ec24aa35ad2f.tmp

Filesize
10KB

MD5
f00aa2d84b7fbe76a47b4a1350b03ee1

SHA1
054333644097a14872f9c086d9dbb61b53353254

SHA256
72eacbbd35e81b51825a961128dd33305c2c82185d147bf6d7fafd1b89a73e0d

SHA512
8b3e6df27f3ac9c50adfc612b434e8a4771caafc28491bd9c4cc7eaf3922c306a078d6346001a7ea15ae0890f028e017e0dbe79845e0a8dbafe901106f9c8c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
2KB

MD5
73c44bf55b361bb78589ca099b4c5d7b

SHA1
34dd91589afc3bb9f6bd63203bda6ec57b757fe3

SHA256
512c968d86d63516286966534a142ee133524530e8382f74a43dc93bc2ad378a

SHA512
f45685b8d5362b5efbbd8de7fe4321d4c33f7bdf38e51bca1169caaa7d3838a83205abf0a35c5a3eba5a3e666d94cd27722d2821a8a1ee8e7d09a0e058872ba4

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
7529f88f60ef0626d21e41021212ab81

SHA1
8b6a79429e7bb7bf69f65aefa6da9cc78e187c31

SHA256
49aa3818ae7542ef4a2402f69c92cd5293394adede6bf62c56e1a50fa72ebdca

SHA512
2317085df4fa33347ec16ee440b072adb2dbea0fa9e4e89433ed0a1f3c77b3ebeaa6a88ae817309b8931479db5d36bede360e9f142f095053922e129a4c1a6c9

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f9f66cf1513bfa89258813243cb8ad1d

SHA1
b18c0c6ec1fed0bf301821177df0c6543ea05159

SHA256
ca01e9b57450600c9cf382febc8c5faf3823bd9c163b37cce501cab3a9abfa13

SHA512
3a5590998367e48f673e91997808a2e10adda8329b9fb1d89fec9e541e5e04fbbaf0bf4684ac4cd9dc4f08e3804f7ea75c5a9e76ce644853fb4f58abb146df2b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State

Filesize
903B

MD5
37900af33c48fdb7104183e9e8dd1b78

SHA1
6a1b9c85081c63f2b77f87d63d627b2a076bd394

SHA256
39248b9389349c7059421f84b8cc7e06e165374e81b0c8b2c2d0638674db10f8

SHA512
062bbc4661ede98c902901456318d90726c259cd76304d6538d5944c25e518260d873857b5254ad17479312f15a034a1e272a84082a7f8d01aee8fd38ddb138e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe597258.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
305B

MD5
8af0868b0d14f277927708e1c6485667

SHA1
4c2c409eeedff6912b615e47c9467411810f0454

SHA256
e979d22bd5ec88c7deff2baa3885ff02e9abfc41c42ef4791f162574f4bf279b

SHA512
809cd88047494bbe6d384b62a4c8860e77c0f4c563805ec227bc1314ae2e94f3306bbfd15b7961fc1b6c26b1bab58d1b327f328007bcc06ec1ebd659c28d2b0e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
417B

MD5
911d9ca103b7053c439fe207e0d800d0

SHA1
853318bf993c02eeb778a7abe5c052c4ebf1491f

SHA256
16eeb1d796ed8182404366279a98dacb23f15ef67b84a93927c84dfef9d41f88

SHA512
4ed6ef51311ba8d2606cffbf6eff79bc83d9f404bb93e25e68129dfa3c42dd72921c8b5b21168940fa68711963e83dd3588bba85f462a9816fa81fb0e6338c31

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe58a301.TMP

Filesize
96B

MD5
b5682f94a6a74f4ec75d8bdc2a642cc5

SHA1
5843844fe720177923dea43d2215ed2d9efc04a2

SHA256
8ff986ea261846129afbf92aefbcca255b66943bfa1854f192e5ac6ece752621

SHA512
2ad8ca3f874471525157d7295602751b46b4e78ea004654c65fa62ab3fb5c5783621bf6e287f0581e65d654414e76ece52583731e804bb90332f1d3944fa5ff5

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-09-02_01-56-43\config.ini

Filesize
101B

MD5
72d74873a9d7f5905ffe33abbb83ce5c

SHA1
bde774f7a4e2e0320a80e8b6bcfd3f1d496fd966

SHA256
45c2bc29abefa7af80b4ae0bb3e67feb1c2ab2e54922915839099cc6fcf78b43

SHA512
ce7fc7b3c39300fb8e7a438ecc21849e4f62055baace0e0c3f44db8fde905f057dd48c7cc41b28234e38154cb9a54d9d4c81c9fd5afb3a0e9964b5685867986b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ohvyphms.b1u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
3.5MB

MD5
e9846e050aaeef7832434bd4f3cf74ad

SHA1
6d5f53821a06b34c5a3f3affc09762025b5f0db8

SHA256
5846ec7b50c9e1fef4916347e93f5b33899d06d816d7e7a6a107b161400cdfcd

SHA512
df212a5a0404af9d414ef5f7e797281c776f9ab8002c2f7c67df7fa568ce7fcee933c7f85aacf66f9edf4768bf5f08db12a15eac4528618e1bf3a0e3c8784544

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
33.8MB

MD5
a8b0089fc441a9654d781823b31fc85a

SHA1
bc3317bade99fbebb94318b93cdc8f384c948b82

SHA256
b23746f04a8c00dfa531183d4abfdfdcdf4079330c3ebae8e670fb0989d68485

SHA512
8e95c601ea0726a985a46f4fceb1a37cd371d197ac23433784779de32d6e0ff300a14ff8a6c38fe8db97089cb2be7849c73f5e11d25c701d147cf57418948401

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
665KB

MD5
08d5b9ba6de2fdfeba949a500788d3db

SHA1
a501a28ab57cbceec7096fceea8f59adf1c49d56

SHA256
617368e617aa56193eec7b21a05edc3116314434cf490cba13109084468fab2d

SHA512
acd5305032fb6c4da5f594804e0c7253d8370c8dda9f709a2385daaa193261b0d0885394fbc888438b326d363992466e67c7ab1e620d89490ef2ad7942bcf11e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
593d0c686b7e657fe8fecb6f87793bfa

SHA1
c9364f2efd003e69e9e13a47c30ce41e0ae45c64

SHA256
65ea636b01f8deb739d65d0a2244f1e476efa9df06ea2bfe06cb3107dad465a8

SHA512
69cfc43e5038a9c52e78a443e8745c343844d5041c4780e1792f0ac9d5fedacd0d82e4805276f01ca0c9692f786ea8c1164c5bc36aafe94233b8883886478c73

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.3MB

MD5
067fd9866c7ebbcb0228161627061fbc

SHA1
28b229da92b05477815b0ec0bcf45d88bface843

SHA256
becf2b4384496e44b0b600a226170bbc9724645bdd0ad39bb561904d6f9b1df9

SHA512
5597d1af5ab799aaa7c1f0f8b6466dc73c0ec6980bcd6b85780c12ce57c3432b0e9163732bcba1cf1e86490409be2661f4d0395c40eff403c0a1b4cb533da00e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
603B

MD5
38e00009737071c00590b944da6b4c25

SHA1
c1614ef3706538e5df7c411741ae5e18339d716a

SHA256
312aee1310a36d2ffd6306b3ee9452fa37cf25b808dfceb853afd060c58aaa6c

SHA512
5232512898e7f3755d37181c990bb6286563057c1aa3dfc1f56a6452fc12b00698dc4dd9801659f6ff9017e9f00f7bd8d313be0fa751d5e83d2f36b69e4ba15a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
4.7MB

MD5
fda904e5a347d8ac3471a7938746e126

SHA1
b37f28eda1fb8540ae86be295cd49a26724d9b43

SHA256
9f182852b4a28edf08d9f95fcd1a2278bdcda01a07541bf8096e1066ae750742

SHA512
a2dfaa98bcbdfee0c9c35200dd0a9c2caa0b58f9d45b59314e43e076ce19b1689f5497da09393f089ba057090b788244885dc13cd2c6ee2ef91bb73472f5838b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\dpapi.dll

Filesize
842KB

MD5
304d94e5b265e29e87a5f38ece1a3630

SHA1
7bf6409cf69d969319ad5cba5fa47695c91ab2bb

SHA256
9dceedac8397d8673c9588c638fa74581f3a5c5ad46867b5976fc487769b977b

SHA512
ba0306c15792f2278dc88e8b1d1b125ddbdd6a7826f75cd1d79a69d913c9d6e022d0255ab9dc13331185f126c82e60d58e74cc637fbbbbcbb6808e37de734ab1

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
463KB

MD5
65a29ef08ee521b053d80779d1b828b9

SHA1
1732065416873ee9a526ac6a7a689a0aad09d3ba

SHA256
b924ad51be3074f6f7e6a613ff5292f8993136f3fee7071efd8174c742f10f61

SHA512
619f7dd86414576def29956011b767de37533219c311c402e26727971a3124314f6136d4c6bd043762ef049bfa0457cb897bc19b45e7942b864f03521122c8e2

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
7.6MB

MD5
53f6fb4f6588ad32e6c6d893810ab370

SHA1
8d5da2851f1bfc5a812f32ad208597107d320731

SHA256
7780b75943c196de42aa900e965754bb994f6fd414df94953e5699525334bc1b

SHA512
0915d605ef4cbc4051bde6686d8740c0a24cc87ca7174392c371778f5525d125e16df2952e18d9a82c886bc9245dcb7d5d62fdaedf5d4e211aad9386bc5e5962

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
473KB

MD5
47ef63cd09a805111daffbaefea61ae2

SHA1
fc16c4a01f07a84983eedf1b775a7e90a7462740

SHA256
486569377bc470c932424935e6d18f9cb752cae1d5d21d9aaedc5d0ee3ebee90

SHA512
86a99afce4a38ae65641a9f120fe90aedbe96fc389ec6c41b61442ccfee466d668e46c9bb7bb588d77ff1803f33ddfd18c3d80aa2be52412064b079913e0018a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
e67df29f9aef1fcacd64aa11e6bf1579

SHA1
928f4dfea93433dbf772c3158522a1b2bfbc0169

SHA256
e269c4cb638b7fdb42462596157b5e6e77843bd60f36b58ba35ee40483fac094

SHA512
7a23994b2d1a33590e08b992c81ebf39551d4f3f278b9a4de9cbb09c7b87e0b578e5cda287d83ee89ac5af3f9e8db90c46d9faeaa0140cccf1ba0a33f9a83346

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.3MB

MD5
5272bdb104b38c8481e8946433aac159

SHA1
933997cc65745e7b90b2b711f9427a20fdb3207f

SHA256
5204d2ed8b2f2fd566955484696a40f25e3c400774073ae697f0472211fa2d7a

SHA512
fd1f0623f9c453538c3d792bba614075186b22f0c4f0851992d37846583a9b104bcdff2324afc3666f4a090fb7304f87753647066b394f80665ba7fe4b82a583

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
656KB

MD5
11e43c7e737f2d2857c665360364a74f

SHA1
0fb05690956f772a40536bd6e0c485ac6dcc89a7

SHA256
27513ca3fb00b59445b1098b3af8ee44761206045c070754160b81c959758564

SHA512
d9391a98be45b83d37997b123396793777a603aad48b66c673fdced5c85ca7246aa23e78adbd62d04b1f7bb0c8981b0a272cdcf33a4353db2a642167b4230952

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
5.0MB

MD5
474a717e1b666878f89b9baaec5a1784

SHA1
eb57ae184ac94c0423171a8dfda718b2bdf41a91

SHA256
67787fbc92a35efd5bbc0bb81de42d5486f8fed2d58a640feee7974d17ce6fe7

SHA512
7d7bd09376cc4438f95a9c927c89864f57b666c8eee4e72a7ca72f76fe8114c9c8b1feb6dd428088af6d987825bcca8dc09c4cf2664f40432454bf6938091bd6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 337383.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 785361.crdownload

Filesize
338KB

MD5
04fb36199787f2e3e2135611a38321eb

SHA1
65559245709fe98052eb284577f1fd61c01ad20d

SHA256
d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

SHA512
533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

Download Submit
memory/392-814-0x0000019FF7F20000-0x0000019FF804A000-memory.dmp

Filesize
1.2MB

Download
memory/392-815-0x0000019FF8050000-0x0000019FF811D000-memory.dmp

Filesize
820KB

Download
memory/1300-234-0x00007FF7EB320000-0x00007FF7ED533000-memory.dmp

Filesize
34.1MB

Download
memory/1300-414-0x00007FF7EB320000-0x00007FF7ED533000-memory.dmp

Filesize
34.1MB

Download
memory/2340-421-0x0000017204E50000-0x0000017204F7A000-memory.dmp

Filesize
1.2MB

Download
memory/2340-368-0x00007FF8A6240000-0x00007FF8A6241000-memory.dmp

Filesize
4KB

Download
memory/2340-367-0x00007FF8A6CE0000-0x00007FF8A6CE1000-memory.dmp

Filesize
4KB

Download
memory/2340-422-0x0000017205180000-0x000001720524D000-memory.dmp

Filesize
820KB

Download
memory/2684-27-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2684-28-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2684-38-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-23-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-18-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-1-0x00000179DEEC0000-0x00000179DEEE2000-memory.dmp

Filesize
136KB

Download
memory/2996-235-0x00000179DF760000-0x00000179DF772000-memory.dmp

Filesize
72KB

Download
memory/2996-236-0x00000179DF750000-0x00000179DF75A000-memory.dmp

Filesize
40KB

Download
memory/2996-11-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-0-0x00007FF88A013000-0x00007FF88A015000-memory.dmp

Filesize
8KB

Download
memory/2996-12-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-39-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-13-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-277-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-14-0x00000179DF2E0000-0x00000179DF2F6000-memory.dmp

Filesize
88KB

Download
memory/2996-24-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-15-0x00000179DF2D0000-0x00000179DF2DA000-memory.dmp

Filesize
40KB

Download
memory/2996-16-0x00000179DF6E0000-0x00000179DF706000-memory.dmp

Filesize
152KB

Download
memory/2996-22-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-21-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-20-0x00007FF88A013000-0x00007FF88A015000-memory.dmp

Filesize
8KB

Download
memory/2996-19-0x00000179DF370000-0x00000179DF384000-memory.dmp

Filesize
80KB

Download
memory/2996-251-0x00007FF88A010000-0x00007FF88AAD1000-memory.dmp

Filesize
10.8MB

Download
memory/2996-17-0x00000179DF340000-0x00000179DF366000-memory.dmp

Filesize
152KB

Download
memory/4820-263-0x00007FF828C50000-0x00007FF828C60000-memory.dmp

Filesize
64KB

Download
memory/4820-353-0x00007FF828C50000-0x00007FF828C60000-memory.dmp

Filesize
64KB

Download
memory/4820-265-0x00007FF828C50000-0x00007FF828C60000-memory.dmp

Filesize
64KB

Download
memory/4820-278-0x00007FF7EB320000-0x00007FF7ED533000-memory.dmp

Filesize
34.1MB

Download
memory/4820-352-0x00007FF828C50000-0x00007FF828C60000-memory.dmp

Filesize
64KB

Download
memory/4820-416-0x00007FF7EB320000-0x00007FF7ED533000-memory.dmp

Filesize
34.1MB

Download
memory/4912-423-0x000001EFC2FD0000-0x000001EFC30FA000-memory.dmp

Filesize
1.2MB

Download
memory/4912-424-0x000001EFC33A0000-0x000001EFC346D000-memory.dmp

Filesize
820KB

Download
memory/5340-1321-0x000002E47FC70000-0x000002E47FC71000-memory.dmp

Filesize
4KB

Download
memory/5340-1322-0x000002E47FC70000-0x000002E47FC71000-memory.dmp

Filesize
4KB

Download
memory/5340-1325-0x000002E47FC70000-0x000002E47FC71000-memory.dmp

Filesize
4KB

Download
memory/5340-1324-0x000002E47FC70000-0x000002E47FC71000-memory.dmp

Filesize
4KB

Download
memory/5340-1323-0x000002E47FC70000-0x000002E47FC71000-memory.dmp

Filesize
4KB

Download
memory/5340-1316-0x000002E47FC70000-0x000002E47FC71000-memory.dmp

Filesize
4KB

Download
memory/5340-1317-0x000002E47FC70000-0x000002E47FC71000-memory.dmp

Filesize
4KB

Download
memory/5340-1315-0x000002E47FC70000-0x000002E47FC71000-memory.dmp

Filesize
4KB

Download