9e71d03181600209f01eb261db7ebf6fbdfee38ec1ac1974d7f61f75895473d3

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2022, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spotify1-1-73-517.exe
Size

70.6MB
MD5

567a2857c6f4b381ce27107cb392c0e9
SHA1

ca57b08470d6281792ba78d722d48718d3439d79
SHA256

9e71d03181600209f01eb261db7ebf6fbdfee38ec1ac1974d7f61f75895473d3
SHA512

0850eda05cfdac6fe7d678bb6e22040cbe856ed6bd78c68a52846a40fc6c89a10ce95567df8d62f461193ff3929dca4a6b6c0b5bdc3cf1f661b8f420fc281336
SSDEEP

1572864:6Vt/59XSZMUZ7Q/3PjtWomEglhE5Hm2Fyh4vWVN9FNXLs:kpXSZzNQJ9glhE5rFyheWL

Score

8^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
4744	Spotify.exe
2928	Spotify.exe
4352	Spotify.exe
5100	Spotify.exe
3308	Spotify.exe
5096	Spotify.exe
4016	Spotify.exe
4728	Spotify.exe
4544	Spotify.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Spotify.exe

Loads dropped DLL 21 IoCs

pid	Process
4744	Spotify.exe
4744	Spotify.exe
2928	Spotify.exe
2928	Spotify.exe
4352	Spotify.exe
4352	Spotify.exe
4352	Spotify.exe
4352	Spotify.exe
4352	Spotify.exe
4352	Spotify.exe
4352	Spotify.exe
5100	Spotify.exe
5100	Spotify.exe
3308	Spotify.exe
3308	Spotify.exe
5096	Spotify.exe
5096	Spotify.exe
4016	Spotify.exe
4016	Spotify.exe
4728	Spotify.exe
4728	Spotify.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4408	2128	WerFault.exe	14

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2220"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10677"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2209"	SearchApp.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8197"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8197"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2220"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2712"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2712"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10677"	SearchApp.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2712"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2209"	SearchApp.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8856"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2209"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "10677"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7015"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7015"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7015"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\spotify\shell	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8197"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\spotify	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10666"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8856"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10666"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "10666"	SearchApp.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173"	SearchApp.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4884	WINWORD.EXE
4884	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3308	Spotify.exe
3308	Spotify.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4744	Spotify.exe
4744	Spotify.exe
4744	Spotify.exe
4744	Spotify.exe
4744	Spotify.exe
4744	Spotify.exe
4744	Spotify.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4744	Spotify.exe
4744	Spotify.exe
4744	Spotify.exe
4744	Spotify.exe
4744	Spotify.exe
4744	Spotify.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3816	SearchApp.exe
4884	WINWORD.EXE
4884	WINWORD.EXE
4884	WINWORD.EXE
4884	WINWORD.EXE
4884	WINWORD.EXE
4884	WINWORD.EXE
4884	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 4744	1228	Spotify1-1-73-517.exe	88
PID 1228 wrote to memory of 4744	1228	Spotify1-1-73-517.exe	88
PID 1228 wrote to memory of 4744	1228	Spotify1-1-73-517.exe	88
PID 4744 wrote to memory of 2928	4744	Spotify.exe	92
PID 4744 wrote to memory of 2928	4744	Spotify.exe	92
PID 4744 wrote to memory of 2928	4744	Spotify.exe	92
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 4352	4744	Spotify.exe	95
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98
PID 4744 wrote to memory of 5100	4744	Spotify.exe	98

C:\Users\Admin\AppData\Local\Temp\Spotify1-1-73-517.exe
"C:\Users\Admin\AppData\Local\Temp\Spotify1-1-73-517.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  Spotify.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.73.517 --initial-client-data=0x44c,0x454,0x458,0x450,0x45c,0x74ef6a30,0x74ef6a40,0x74ef6a4c
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2928
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --field-trial-handle=1776,3030938316916316882,1434601492293964572,131072 --disable-features=CalculateNativeWinOcclusion --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/94.0.4606.71 Spotify/1.1.73.517" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1816 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4352
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1776,3030938316916316882,1434601492293964572,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="Chrome/94.0.4606.71 Spotify/1.1.73.517" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3024 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5100
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/94.0.4606.71 Spotify/1.1.73.517" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --field-trial-handle=1776,3030938316916316882,1434601492293964572,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    PID:5096
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1776,3030938316916316882,1434601492293964572,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/94.0.4606.71 Spotify/1.1.73.517" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3032 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3308

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 2128 -ip 2128
1⤵
PID:4936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2128 -s 2484
1⤵
- Program crash
PID:4408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1324

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\622b80fff23e405497906d455636b4a0 /t 3568 /p 3528
1⤵
PID:1676

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3816

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Recently.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4884

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
PID:4016
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.73.517 --initial-client-data=0x444,0x448,0x44c,0x420,0x450,0x74ef6a30,0x74ef6a40,0x74ef6a4c
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4728
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --field-trial-handle=1400,17391539125285984701,5745454212289432282,131072 --disable-features=CalculateNativeWinOcclusion --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/94.0.4606.71 Spotify/1.1.73.517" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1400,17391539125285984701,5745454212289432282,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/94.0.4606.71 Spotify/1.1.73.517" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4900
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1400,17391539125285984701,5745454212289432282,131072 --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="Chrome/94.0.4606.71 Spotify/1.1.73.517" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4968
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/94.0.4606.71 Spotify/1.1.73.517" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --field-trial-handle=1400,17391539125285984701,5745454212289432282,131072 --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Spotify\Browser\Visited Links

Filesize
128KB

MD5
32861b8152cec6bbd1e72df66979e5b2

SHA1
7d1ad7ae9efce89d512e1edb58d66685baa5ad3b

SHA256
297abadb3a27dc7854e2b3af2dc6ca07e8585a600ab6c74d769f9d1e56660ec2

SHA512
3959013f91433e54c080eb0429e3abd29dc4d1f4c9f61a43476aecf4c0337a52642a7adc1842d93e4d914c64e2350b7bd8d8e58ab5a24f7039cafb72f8bf1d16

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
633B

MD5
192af43098a772ab2d4dc619e4cd65c4

SHA1
063d5c9b1a21663e03dfae24b40e8c6e6b2af862

SHA256
70cdbfdffcb957a98303563deecd2bfee6697b1589b13641040eb647943ac026

SHA512
88218a25a1f6a9bb119ca1b9d3c8ca7f8ce1169f37402b0bbda41aa2bfdb208a17e45a365c55dc967dc1bb99ae58f7630f094fc0be13f943c0daba20b2ba487f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
3b177be52fbcbefc10f514d4e1fa7922

SHA1
7ece504651f1c053e11611067359fbf778350187

SHA256
690285cad1dc7070118e1eda07074284779074cd5454086476e3572d30b86155

SHA512
7b7d1a3783ffe7688cc599ad7056731e96bb6f8a68e63314efa78a30301030b7614957d6cb3b1e29b5367b2427cab09d9353d3d826f46faf892b1eb27730b139

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
3b177be52fbcbefc10f514d4e1fa7922

SHA1
7ece504651f1c053e11611067359fbf778350187

SHA256
690285cad1dc7070118e1eda07074284779074cd5454086476e3572d30b86155

SHA512
7b7d1a3783ffe7688cc599ad7056731e96bb6f8a68e63314efa78a30301030b7614957d6cb3b1e29b5367b2427cab09d9353d3d826f46faf892b1eb27730b139

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000003.log

Filesize
165B

MD5
2d10374b7d4ffd915e63ae446089ac27

SHA1
bd17b77105837fd20d13fd245fd723853b385d08

SHA256
f7e6aa49cb10058a80758e125d1c95aaced9e748ae4714ad28d3d820040b677e

SHA512
6636a84c56f1804d291b1f9a3271cba641dd1cb3a6b20ed81bf719a64a178fb7cd5351aafedf21887e99cbfe0e750313c460211262c222ed56b91b210253106e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\LOG

Filesize
50B

MD5
0ad040aaa7863070a16a0b1cb70c150e

SHA1
ba4633d92165fbabfce45bf2f9ae628c54a9ba6c

SHA256
203890d5db3ddf7bebce5f8c7c60596868c50b85c73a4198c0c65b118c94e0e4

SHA512
af94edd7c487343c180e5a5849df1cb94e81682448365cd4a893370124a6c6503fec2207cfe73b8f5b9de3fa2be0b8f54e1a89a71d64b113c9271092f26a3e59

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\MANIFEST-000002

Filesize
47B

MD5
a4d642826fc35b8cae6ba472ab589194

SHA1
0c9c6beaee54499b5ae1d6c01294fbfb025eff5f

SHA256
f66582c281a2ba2242b479929a44b9468363711146dcd25b86818276d4a9ddfe

SHA512
3617a1442110ce1f1a57b535fd3df3f147ca4c5eccebfb0382227aba2260dbc5e8b786b17e307e8beaf0ec6717ede8463c6fc809f9b5a2eb09dc9fea8e75bd26

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
1.4MB

MD5
731b2dc006aa29ed1887cedda09af62f

SHA1
8ad7c2f8b6060ba1ae9203a09d8f294df09ec93d

SHA256
5727e74611b3c42e049c4bcfc519bac268639ef68a6905d7468ba57340fd35d8

SHA512
e9a353c8a191ec95c091a93adb6c98bdd82f4224e1ce3ae290d6130ce328448cc8e0d27576cb4011595a764ba45bc25a815967382b1a9d274491033e0135c0f4

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll

Filesize
3.9MB

MD5
609d3bfdbf153a74d85375a745a0d4e2

SHA1
0bd0073186dfef93c722a65de309c7132c6c97ac

SHA256
9cb657c10545e4be44c833831aa86476e44136ea27b7ee512e49f536880e3785

SHA512
3ca40c66b1f9dd7ecb60772f36f8779b71079ab1aabd81b8d796c5721cc0c8bde7ad0ee2932af01ff510a934e158e07c61c02f9dab9e89c2e0d46fa5d7d36927

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.1MB

MD5
cc32b4a1ac874200b3792559b932ec26

SHA1
037e9cc69bb2d1f586ffb1b858f4af4cc40a40a1

SHA256
5e298de0ad17cff2fd08fb0620504d67dd48d1c03da46cd79ffef6eeef8c9363

SHA512
006e4b7652869c56101b0ae37b840d3ab2e84cdd2806cb2a6891e0fa34ff2d94c891bb6cc1e6cec8ecc1923a64be905588d7a0249e300b9b39eacd3ab02d4661

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
614KB

MD5
7c2a51641cd02938d3cd8c58370c6d23

SHA1
72346f5f43efe86d7ddd1cd6117aee213977fe1d

SHA256
71e0080e8718d86b8356eca9f19a9ae7b898adf0a1b175f35a6813bf73b4f660

SHA512
c04c1c21d42093ea941cf0338d84abf6f5c8c17e9cb21930816858c29f35226a00e414c90b4633ce530153e77a2d138cc0aeb53ee7d896fe003b0a3f34bc90b9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
919KB

MD5
3a8f22265673effc9a31c2c906a0dc34

SHA1
90c489f3e1cc0347c21fb4e2b46f30f7057deb5d

SHA256
c5b31e8f2904883ad272f59a1beab3663ae2688eec847794c361649bdad319f6

SHA512
988a9cac09bd18749c620b589f3b2c955f48741d87944ebe6bc862de9b17353e360dc48010a15edfbc0f1fa56365739323702b69dd57b208f05353f3ba03cd98

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
949KB

MD5
a366d1da7c624cbcd0574c6da50822db

SHA1
cbeb830ab7dbaa0382ef8b274a4d53b8523e1efb

SHA256
abbbed57cd021cb57909330a675ce703e894b20e837574c607565e7bf7d4312d

SHA512
c7950a9bd0bcc3df3190d2eb1b6c9df7940afaac533ff4ac44692d7b305d36d8120a0aabc25eb72ad5592361a3d7825b09f800cbefcb795295b753a518cf2089

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
655B

MD5
0de8df4a5ab170c6f80ba63d80390376

SHA1
9579fea263d2ebdb4a417582d87c2959de5b94b8

SHA256
8e2b9e0007c2a91d249b1d1e4237b8ec2c1dfdfd556bd60eb9157785d6a6e8c9

SHA512
a03bc8b002603e44dd775f914ea08ed08f3e1bd7f54362d96eebe4568ac8d9ed0437c9dfad24353d794f030ef5cb3e3528133ff58df31000272b832e4e600b4e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
609d3bfdbf153a74d85375a745a0d4e2

SHA1
0bd0073186dfef93c722a65de309c7132c6c97ac

SHA256
9cb657c10545e4be44c833831aa86476e44136ea27b7ee512e49f536880e3785

SHA512
3ca40c66b1f9dd7ecb60772f36f8779b71079ab1aabd81b8d796c5721cc0c8bde7ad0ee2932af01ff510a934e158e07c61c02f9dab9e89c2e0d46fa5d7d36927

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
9.7MB

MD5
224ba45e00bbbb237b34f0facbb550bf

SHA1
1b0f81da88149d9c610a8edf55f8f12a87ca67de

SHA256
8dee674ccd2387c14f01b746779c104e383d57b36c2bdc8e419c470a3d5ffadc

SHA512
c04d271288dd2eff89d91e31829586706eba95ffbab0b75c2d202a4037e66a4e2205e8a37ecf15116302c51239b1826064ed4670a3346439470b260aba0ea784

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
334KB

MD5
70fce613fb748691cada80536c95bb1d

SHA1
5460379674248b1943adb0da0c2920bf0f0cc60d

SHA256
ccadd45f3e89237464b3d466cd3ab212e8ac9841f1cfa330efbbb70a6fb15c95

SHA512
d339289362b09d6a1fd8e512b451f418e9231a789d3d4eb7553aec5ec089f2aeaa23a440b11671f44ed24372c5451c1772e47163940a7b243c756a5b2f92b1ea

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
5.5MB

MD5
f2144935607946f62cefa63d6afee428

SHA1
65e21e7c313b1b36ae767ba045251184a7a73473

SHA256
4b03238dfe12bd0d738e336378627ea3f4457a97641b0fde31c4f66c2ba8f77b

SHA512
85c584188183c0407405e1bdb6fd2f85679db59828ad9ee5f0ce980d51bb354bb688ffd1f7aaa4cd6b6bf25e6c477d32282cea862e8205ab21c4e7c11f98fb52

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
130.2MB

MD5
e7bb3949e634ed4e05224884cc20c0d1

SHA1
7e097a8d99d3081026713433e3c3dbab3d5513e4

SHA256
7d49845ea7e3434608634bbd608d2d7b8702ed1caaba861255191af6c636fcf1

SHA512
0df2535a359f48344758eea09820dc4d1a0e5334b0ac456da675c284bb9675a710974df26b126e06f2265ebdff1c27416b5ebcb068241968c7ca6fd47833bc5c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
46.7MB

MD5
66c3b876e789ec0da4f436e7e11d1358

SHA1
a12833a96fec248a23c208144dddc38e44b9fa57

SHA256
80516ed87b64401785b4c116220d0b7747a67689fca26e868f7ff4e3a72c7bc8

SHA512
02beecab4e126773a9ddb51992cc42d7a6c4c2cdc3edca5cc2cdc71cd6089d40b0e386b433c77b61830ea2c1b3ccd68ee43334ea3e104a829888944f6ca221b5

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
35.1MB

MD5
e5f99a293722a7999e77031fab3f4307

SHA1
ae285a6ba7cf5a3e6c87bdf66b712de6453c9c71

SHA256
7bf750728fe0bdc6ff9d56d30defcbd32d61939a29fd48feaf6c49fb9b718be4

SHA512
3fe514bca8f3c11dc04991cbb13457e6da8c5e3664ada846af4bd08639542007b51435fb2b339201610d8cec7d99417b32e690439a3a5ae749f1596306378a42

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
28.3MB

MD5
dd259ad3f2d48018c9396d6ee1379eb4

SHA1
f8c1e29ee4f9cf894a34845e061f52310dbcaff2

SHA256
cbecc3adf9a582bb318d96c1dace1b4db4e3be5bb8367ad01acd4d774a2b393b

SHA512
69a9794d09788af7f39dc58a1f11f1df98dae0be0253069fcf0fb7723380c8957066936d97000cd905a205e8135f921804ce0a730ddb7b4927f042caedced6d9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll

Filesize
334KB

MD5
70fce613fb748691cada80536c95bb1d

SHA1
5460379674248b1943adb0da0c2920bf0f0cc60d

SHA256
ccadd45f3e89237464b3d466cd3ab212e8ac9841f1cfa330efbbb70a6fb15c95

SHA512
d339289362b09d6a1fd8e512b451f418e9231a789d3d4eb7553aec5ec089f2aeaa23a440b11671f44ed24372c5451c1772e47163940a7b243c756a5b2f92b1ea

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
5.5MB

MD5
f2144935607946f62cefa63d6afee428

SHA1
65e21e7c313b1b36ae767ba045251184a7a73473

SHA256
4b03238dfe12bd0d738e336378627ea3f4457a97641b0fde31c4f66c2ba8f77b

SHA512
85c584188183c0407405e1bdb6fd2f85679db59828ad9ee5f0ce980d51bb354bb688ffd1f7aaa4cd6b6bf25e6c477d32282cea862e8205ab21c4e7c11f98fb52

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
283KB

MD5
f88e6aba546bb5120325126549b97168

SHA1
dd415b6cbacaeb79f6d5f6463e4e9a74cf5a6d6c

SHA256
a171d2118fd8607f572fa39d950b81cf83e2146a73385a9fadb1500aa14daa58

SHA512
dbde9991abe4eb617f81ab859424c9a06955232392b660798450e2a6222704e0338f2139d845c222bfdffb280e155bfd1fd16ce63f747887636fe5700a846368

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
13KB

MD5
e4811d2bb8407116c9d38ed98b7899be

SHA1
4624bc6a51f6408b96d9d96017e8fd251c8cbf34

SHA256
351707b2e6c2b86eef15068018a02d987c58091259f08007a9b3c70d72fcaffd

SHA512
03ff1f2408594cd3e7db9e47756ecb4e2ec7a8f09a75c9b1f9fe4aabea49cead11543636eb462bed1ff5473004f42ee344c340aeb7d68531c4b2bc66e1c01f07

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\prefs

Filesize
176B

MD5
b816c955db2b9db68358187c0c728719

SHA1
9f49eb3e0aa21759c6be925931ce785b98a1b687

SHA256
9914a0c7ed27b4aa3a0717dc6423cff3ed712c8272104087ab9952094fca139d

SHA512
66021701c32873b80ec46303064b1fb8afdaced3743e2d074ec4efededb92feb883137652eccf41ed8efd8607b0c1f3df83c2b2fd422d05d86772ecdebfa7553

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
7.3MB

MD5
b528671cd4f9a9764b928969a1b2a164

SHA1
749e4d0faae9524b8226d156748c9b0f0082192e

SHA256
3b4cf4697df9b0cdea15f31faa57701e61847016c74642abcda634243874bb08

SHA512
5706b4d9895856a3b06f9a50c146855bbb551cb7ee39ada98da5d7ee2b56dc440795ac8c163e268c8f03072411a9008d1b69b0a4fb4ec14ad6396887c5a01822

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
160KB

MD5
4fba5ce8bf10e7e11a34aba5986e329e

SHA1
278895f187db7f798d6a44639b3c14a1c0f4683a

SHA256
7f372b919a89f10f7b08adba9d9ad716910bc83d7a03f07eec392a0cd324a3aa

SHA512
f2935074fa23e8aac2a89f147b0157fa952b7cbc29f73c67cedfc60aad250e12bb7e401eb6dada28fcd3aa7d4e8c09fa9c31c4effb05225c06e5fa6866e40be1

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
3.2MB

MD5
ecf9b4bcd44f7a1b3ce4d0c060714711

SHA1
c19b093c54236fc1bf23b2ba4a1670e845c3861f

SHA256
a39e730aafb391eaef4a71b4d687d50ea1819de581222ee4a2543dbf1885b0ad

SHA512
1f1c7a1b67c424d97f38703b3fdba498f7e140522ec520afa0bb0c14f500873d9bb6715a932400b2f3f194e709dd4dba844593a075f5081def004b4a0b3553f2

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
3.2MB

MD5
ecf9b4bcd44f7a1b3ce4d0c060714711

SHA1
c19b093c54236fc1bf23b2ba4a1670e845c3861f

SHA256
a39e730aafb391eaef4a71b4d687d50ea1819de581222ee4a2543dbf1885b0ad

SHA512
1f1c7a1b67c424d97f38703b3fdba498f7e140522ec520afa0bb0c14f500873d9bb6715a932400b2f3f194e709dd4dba844593a075f5081def004b4a0b3553f2

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll

Filesize
599KB

MD5
355f9553102344f02afc2ed9f9c12155

SHA1
19a8d4de052c728fd7dfe3a9ffed2416d0763586

SHA256
2ef78bdba1ef0be4155217e7438d9f81b9005738ca17f20e189bec43676336a0

SHA512
10d99a187c3e0a1954d45940524239a1cc687a6e4b14c683feebe00ab9d1fe38945cf17ca181300658d31a0091aa145d6cf16b33f14599e22fdff61a4687d886

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll

Filesize
599KB

MD5
355f9553102344f02afc2ed9f9c12155

SHA1
19a8d4de052c728fd7dfe3a9ffed2416d0763586

SHA256
2ef78bdba1ef0be4155217e7438d9f81b9005738ca17f20e189bec43676336a0

SHA512
10d99a187c3e0a1954d45940524239a1cc687a6e4b14c683feebe00ab9d1fe38945cf17ca181300658d31a0091aa145d6cf16b33f14599e22fdff61a4687d886

Download Submit
memory/2928-159-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/3284-280-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/3308-196-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/3308-193-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/3816-216-0x0000021DDDAF9000-0x0000021DDDAFC000-memory.dmp

Filesize
12KB

Download
memory/3816-221-0x0000021DDDAFE000-0x0000021DDDB02000-memory.dmp

Filesize
16KB

Download
memory/3816-222-0x0000021DDDAFE000-0x0000021DDDB02000-memory.dmp

Filesize
16KB

Download
memory/3816-224-0x0000021DDCDC0000-0x0000021DDCDC8000-memory.dmp

Filesize
32KB

Download
memory/3816-226-0x0000021DDDB12000-0x0000021DDDB15000-memory.dmp

Filesize
12KB

Download
memory/3816-227-0x0000021DDDB12000-0x0000021DDDB15000-memory.dmp

Filesize
12KB

Download
memory/3816-228-0x0000021DDDB12000-0x0000021DDDB15000-memory.dmp

Filesize
12KB

Download
memory/3816-206-0x0000021DDD0D0000-0x0000021DDD0D8000-memory.dmp

Filesize
32KB

Download
memory/3816-220-0x0000021DDDAFE000-0x0000021DDDB02000-memory.dmp

Filesize
16KB

Download
memory/3816-219-0x0000021DDDAFE000-0x0000021DDDB02000-memory.dmp

Filesize
16KB

Download
memory/3816-218-0x0000021DDDAFE000-0x0000021DDDB02000-memory.dmp

Filesize
16KB

Download
memory/3816-215-0x0000021DDDAF9000-0x0000021DDDAFC000-memory.dmp

Filesize
12KB

Download
memory/3816-214-0x0000021DDDAF9000-0x0000021DDDAFC000-memory.dmp

Filesize
12KB

Download
memory/3816-213-0x0000021DDDAF9000-0x0000021DDDAFC000-memory.dmp

Filesize
12KB

Download
memory/3816-208-0x0000021DDD6C0000-0x0000021DDD6E0000-memory.dmp

Filesize
128KB

Download
memory/4016-255-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/4352-197-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/4352-191-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/4544-276-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/4728-256-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/4744-136-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/4744-195-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/4744-198-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/4884-237-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp

Filesize
64KB

Download
memory/4884-239-0x00007FFF58060000-0x00007FFF58070000-memory.dmp

Filesize
64KB

Download
memory/4884-234-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp

Filesize
64KB

Download
memory/4884-235-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp

Filesize
64KB

Download
memory/4884-236-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp

Filesize
64KB

Download
memory/4884-244-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp

Filesize
64KB

Download
memory/4884-238-0x00007FFF58060000-0x00007FFF58070000-memory.dmp

Filesize
64KB

Download
memory/4884-243-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp

Filesize
64KB

Download
memory/4884-242-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp

Filesize
64KB

Download
memory/4884-233-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp

Filesize
64KB

Download
memory/4884-241-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp

Filesize
64KB

Download
memory/4900-279-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/4968-278-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/5096-194-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download
memory/5100-192-0x0000000000400000-0x0000000001630000-memory.dmp

Filesize
18.2MB

Download