47dd3b96d620554569a957c1571b202f224a6ba2432cee71530613e1743fc0ac

Analysis

max time kernel
172s
max time network
174s
platform
windows10-1703_x64
resource
win10-20220812-es
resource tags

arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
04/01/2023, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpotX-Win-main/scripts/Install_Auto.bat
Size

449B
MD5

ae5b5329e4bda4d1525d5e1302e424db
SHA1

dba437425472d5e18bfb3cffe7f4d10d3d47d71a
SHA256

c5f45c9754466e9fb50d797c11ab4d62621a268cb269d8b1b9b343b979ce584b
SHA512

d3ac64a1ff59ec69cc5d91b2eb16e2ee3773184da8060974ac0b1b4aac33b0db2423fcd23ed2e19b5217362764b46c1e1149abb30852bbba2077f86feedbab5f

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	384	powershell.exe
4	384	powershell.exe
7	384	powershell.exe
9	384	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
3388	Spotify.exe
1176	Spotify.exe
3584	Spotify.exe
3228	Spotify.exe
600	Spotify.exe
2080	Spotify.exe
2560	Spotify.exe
3812	Spotify.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Control Panel\International\Geo\Nation	Spotify.exe

Loads dropped DLL 19 IoCs

pid	Process
1176	Spotify.exe
1176	Spotify.exe
3584	Spotify.exe
3584	Spotify.exe
3228	Spotify.exe
3228	Spotify.exe
3228	Spotify.exe
3228	Spotify.exe
3228	Spotify.exe
3228	Spotify.exe
3228	Spotify.exe
2080	Spotify.exe
600	Spotify.exe
2080	Spotify.exe
600	Spotify.exe
2560	Spotify.exe
2560	Spotify.exe
3812	Spotify.exe
3812	Spotify.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\spotify\shell	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe
384	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	powershell.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe
Token: SeCreatePagefilePrivilege	1176	Spotify.exe
Token: SeShutdownPrivilege	1176	Spotify.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1176	Spotify.exe
1176	Spotify.exe
1176	Spotify.exe
1176	Spotify.exe
1176	Spotify.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1176	Spotify.exe
1176	Spotify.exe
1176	Spotify.exe
1176	Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 384	5020	cmd.exe	68
PID 5020 wrote to memory of 384	5020	cmd.exe	68
PID 384 wrote to memory of 500	384	powershell.exe	70
PID 384 wrote to memory of 500	384	powershell.exe	70
PID 1340 wrote to memory of 1856	1340	explorer.exe	72
PID 1340 wrote to memory of 1856	1340	explorer.exe	72
PID 1340 wrote to memory of 1856	1340	explorer.exe	72
PID 1856 wrote to memory of 3388	1856	SpotifySetup.exe	74
PID 1856 wrote to memory of 3388	1856	SpotifySetup.exe	74
PID 1856 wrote to memory of 3388	1856	SpotifySetup.exe	74
PID 384 wrote to memory of 1176	384	powershell.exe	77
PID 384 wrote to memory of 1176	384	powershell.exe	77
PID 384 wrote to memory of 1176	384	powershell.exe	77
PID 1176 wrote to memory of 3584	1176	Spotify.exe	78
PID 1176 wrote to memory of 3584	1176	Spotify.exe	78
PID 1176 wrote to memory of 3584	1176	Spotify.exe	78
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 3228	1176	Spotify.exe	79
PID 1176 wrote to memory of 600	1176	Spotify.exe	81
PID 1176 wrote to memory of 600	1176	Spotify.exe	81
PID 1176 wrote to memory of 600	1176	Spotify.exe	81
PID 1176 wrote to memory of 600	1176	Spotify.exe	81
PID 1176 wrote to memory of 600	1176	Spotify.exe	81
PID 1176 wrote to memory of 600	1176	Spotify.exe	81
PID 1176 wrote to memory of 600	1176	Spotify.exe	81
PID 1176 wrote to memory of 600	1176	Spotify.exe	81
PID 1176 wrote to memory of 600	1176	Spotify.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpotX-Win-main\scripts\Install_Auto.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "&{[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12}; """"& { $((Invoke-WebRequest -UseBasicParsing 'https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/Install.ps1').Content)} -confirm_uninstall_ms_spoti -confirm_spoti_recomended_over -podcasts_off -cache_off -block_update_on -start_spoti """" | Invoke-Expression"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-01-04_14-59-11\SpotifySetup.exe
    3⤵
    PID:500
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.2.582 --initial-client-data=0x3f0,0x3f4,0x3f8,0x3cc,0x3fc,0x6956ed00,0x6956ed10,0x6956ed1c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3584
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1572 --field-trial-handle=1744,i,294025662623405275,1675936557897182515,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3228
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2424 --field-trial-handle=1744,i,294025662623405275,1675936557897182515,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:600
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2456 --field-trial-handle=1744,i,294025662623405275,1675936557897182515,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2080
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --first-renderer-process --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3368 --field-trial-handle=1744,i,294025662623405275,1675936557897182515,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      PID:2560
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2616 --field-trial-handle=1744,i,294025662623405275,1675936557897182515,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3812

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-01-04_14-59-11\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-01-04_14-59-11\SpotifySetup.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    PID:3388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
bd25c1fd314d318ba5b38e4b1827a807

SHA1
25157697f7db5715f48c5fafbd0b096a5cf48772

SHA256
d807a0d9701d54836ddcd51a1c07bc61ff57d46d90c790e7df9d8fc936453413

SHA512
9bdff6642161f0f66b434e9c49f73842c0998937538fefbba0b7e03cc6884a194245d76a52ebc6ed6a6265f2b7708297329b8114e85031f6c4dd8add9f4a714f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
1.5MB

MD5
13e24f25cda69b8d22a24171ef824ef8

SHA1
b4fceabe143c01cb46254df27cb10244465f13d0

SHA256
82d9ef9b6a8e7fd48bcde8723a89d7b8efd6bf37c50364d2b9c848b7efacd524

SHA512
c18be0a26fc4788cbddc095c449f30ec24682bc79ce84f786fc508cb2c6a4e1803e6ce93fc986b3a5d91b0ef439e9539be27c51c186d4b542e5934f668427fef

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
2.3MB

MD5
5057a0a00170411da226e7c82a579568

SHA1
e542b9f8c5961825e94c2598623cefc176ee6431

SHA256
a695570044289582f346893428c46c594cf92a8578f314741216dea4f0064e82

SHA512
19bd48d69323de7d08fb4933c3c7e4e8e3495de928ff85324c55ef59b3c7a0814a3433248cc43ddc0066328f0cce02df26898879c880e36626776b4e2b01bdab

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll

Filesize
3.9MB

MD5
bce6d0f16abb8d6605ee69e889b37eb7

SHA1
037f19a44a5fa263c533e1185c8aa15200adf0ad

SHA256
67822622dc963c583530930e8011615ed7d1131911dcca493f6fbf443fa9d8c6

SHA512
9211b423135a76e97391f295e147668afad3dde84582450df6acce68bcd3ba79040cdb18f8375b5abb9d9d35692b5504ddbb64a2249b24c2996a9e9cfaf82ce0

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
600KB

MD5
22cffa11d298c474eb466547b5c0097b

SHA1
80d1a13cfeebc1c190838987bcbbec627f4b8c1a

SHA256
d785afc8953892615e480244010b5b25e364f51ef7410214dd883f1d8eb9532b

SHA512
a0df258f240317837314af43b5d9b6ff8b23d9e6a25a07cf6d1d5d26e678729fbd7857670378a879b973b568fd1dffd519ebd2e60e54ba9e26fab5333ae2b23b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
897KB

MD5
237a94cdebd069e219675e525b18a13a

SHA1
691bc1dda1d23e39efa8a25b289e0c4a6a5861ab

SHA256
0aa52b4ed48daaa75412f1a06cebf47fb1e03b5081e052a2f78034d725ce83ef

SHA512
dcfe0f4e4d458c419a245def6e0a972dcfc4bfb34e08865e72eceec87c28b0dd3f44bdc15d4e6ebb05f06d83cccee17158caacc35e564f2133b0524a8cf17d97

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
654B

MD5
c191f9ed1ae79d50e0b75f6d40375911

SHA1
cea54226f42cfbb83a3db9bad22474f4489f94a2

SHA256
d66bbe643943fb21a3c7e56a0b041bb010c6cb14cc4d5dd1f96eb889e341e7e9

SHA512
89d74342cc68d154733e6c4678ff5198b1f4033ff0a4be0c0aa64e2e74f39c2eff39cd8c1c9dfe716132d7b685d0694fbbfb5508ef507e3d2bab3fde296abb9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
25d87a2bb3581bc3597dfb9008516710

SHA1
e3f59f1de852cde2204256c7a8b1580483ab907a

SHA256
b75bd14a3d9a174ee44eca8c62b89c65d9836fcf62c28d103bfa300c02cef255

SHA512
59977fa5ec1dbda7cb6525c48655d6e8f3d7b00408e973efed1f2235d1d7fd88eae443fdd5e07d52f31ce83943aba050c31261baf2798c1b10aeae67981685ff

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll

Filesize
356KB

MD5
bf71eebc1b3a6f2a3a460ec40c0189a6

SHA1
beaeea459eb2a510a2644cc1c65b6993a4e782b7

SHA256
1db4b63469b1c31a2dc47915527a03132383b232d260e85cb8f2c8a4c5b3945a

SHA512
346077f696d87560c1ef7fa56c3a66bbcfa65dea3e0b0c5895db17e63581f5b26ae8e001b592d46b95a403a83ebde0a59e6fd2b51300d70584a5ea237fda777f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
5.4MB

MD5
e6f1df3cd185ee63fd0aa3decba3380d

SHA1
2c1da1115fe2f350e698680842aad008e5c77fa6

SHA256
5d13e04492f3ed595070ed3a1d48d29daf804ca02238ed0f2fef14865d1ce439

SHA512
72bf24071a2fc8324543a56561b8e401fa00757ebd2a01e320a1fdf6f31f876dd7465c392055a6162e1336b7e08d2b3c6ce0e197cfdda88370d8b84f4d8fbf95

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
337KB

MD5
f84dd97190589d26f5ae3721ff2e86f5

SHA1
a73ebc5bb9fba50141e9e399cd170db80de21bb8

SHA256
0cdf3bd5efe01c54962d382b90a670a747391e4e56d1b3e012bc207a292f564a

SHA512
727ca0321210dbab5384f33164b43e8490de837e837dec540480bddd4e899c551021a4500ba493c18513caefe7a875b5c4a6e33e3b4d07ff8f631ae1d07d576d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\es.mo

Filesize
14KB

MD5
0201c52b0aa81af14e438967c965c72c

SHA1
d6d2afe463ee8b05c7b53bd89471039cc273c340

SHA256
8331df25cd78028d98758444cdd9545b3cd6aa5579cc30c19e26e4e79d4c818a

SHA512
a780ce4ab1a64c64d008efc72c59568e3caea109884bf8cdc12bf11a648e814945f3a12defa355076bff5251b15b20ab99912fdbfd073d83b9a274e332a47cca

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
7.2MB

MD5
509c75095d1f285fcf14b152d7746d91

SHA1
5f75577267d44f97a15c9b7d75f289ca7bb8c0a2

SHA256
f76ec95f2fc27c20a4fd8d8dc0b6d17185617204bfbb21ae5269725d6a237c9a

SHA512
a1522f0b3f191e0f85c6d2faa641a6efa6e8dccc3f6ab489d4a2787949d4a9407d8c4065e0fb620a3eb7da7052351a1cccd50aa0be930e46b64f699aaf9e99af

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
590KB

MD5
fd33582b82e5b1e69d18ab4ea1ffad8e

SHA1
0aa2759a29c5592a7ca4170bc4f5bc679b8f66d6

SHA256
55680689bd6daef8d546a530c9dd069fcd560be68430653577118874fa0be8d3

SHA512
c46e656d6cb7b336681ab2f4170a911e13ef804c70ef05033dd64fa7cc8e910958a0be3056907c8330cdef0e5d11a3a5c9d1de9cffa5bade79f6a408f16af90a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
3.5MB

MD5
f1b7a423c6e9f302bd2410ca8842198a

SHA1
03dde3f2513e598650f5b12e8d5288f06410cb93

SHA256
bc9636ea5582f2bff2401c2d01e044eda9e20eec9404169737d388cd68a78840

SHA512
4670fdcb6bf5fac0d1622292bdfccf04b6de48e51be66ce854f32b78c996fc62316a034d37cf411a32f605ecf33a668d5189e6e225fd199c88122d8b490ab49d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll

Filesize
714KB

MD5
6d955287d7576f0ddd2f5a80ca6101c8

SHA1
421e8783ba6056367db58e93d4506263b71bd6f0

SHA256
4d29040978877a946f09c74fa94b1fcb0a5a58ec86b6e18546e1cf8803a3878f

SHA512
64192de602e119fd278e4ecc33c4e7a444875b93fd2e43f6037e85c15e1acbd942fa67c51402dbd7e6661dc93f76e2a41f1e543a344fa54a0a31ebd913027a89

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
bce6d0f16abb8d6605ee69e889b37eb7

SHA1
037f19a44a5fa263c533e1185c8aa15200adf0ad

SHA256
67822622dc963c583530930e8011615ed7d1131911dcca493f6fbf443fa9d8c6

SHA512
9211b423135a76e97391f295e147668afad3dde84582450df6acce68bcd3ba79040cdb18f8375b5abb9d9d35692b5504ddbb64a2249b24c2996a9e9cfaf82ce0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
356KB

MD5
bf71eebc1b3a6f2a3a460ec40c0189a6

SHA1
beaeea459eb2a510a2644cc1c65b6993a4e782b7

SHA256
1db4b63469b1c31a2dc47915527a03132383b232d260e85cb8f2c8a4c5b3945a

SHA512
346077f696d87560c1ef7fa56c3a66bbcfa65dea3e0b0c5895db17e63581f5b26ae8e001b592d46b95a403a83ebde0a59e6fd2b51300d70584a5ea237fda777f

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
5.4MB

MD5
e6f1df3cd185ee63fd0aa3decba3380d

SHA1
2c1da1115fe2f350e698680842aad008e5c77fa6

SHA256
5d13e04492f3ed595070ed3a1d48d29daf804ca02238ed0f2fef14865d1ce439

SHA512
72bf24071a2fc8324543a56561b8e401fa00757ebd2a01e320a1fdf6f31f876dd7465c392055a6162e1336b7e08d2b3c6ce0e197cfdda88370d8b84f4d8fbf95

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
76.9MB

MD5
1484417b6c088184baee6daa859fffc2

SHA1
bb1e8e746664f61e806f85951877a7b2ee36fddc

SHA256
e8f3571ba559f756022429cd653c9203b6de92000e251f3793583ff7c24c9912

SHA512
7a40a8ec0154d9c1df46e450f85679998f000e60780113243c1c7dc97babd829cc2b34ec675806a09be6821348d6fccd0ffd43a82a136453c3b57dc58b0c197c

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
3.5MB

MD5
f1b7a423c6e9f302bd2410ca8842198a

SHA1
03dde3f2513e598650f5b12e8d5288f06410cb93

SHA256
bc9636ea5582f2bff2401c2d01e044eda9e20eec9404169737d388cd68a78840

SHA512
4670fdcb6bf5fac0d1622292bdfccf04b6de48e51be66ce854f32b78c996fc62316a034d37cf411a32f605ecf33a668d5189e6e225fd199c88122d8b490ab49d

Download Submit
\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll

Filesize
714KB

MD5
6d955287d7576f0ddd2f5a80ca6101c8

SHA1
421e8783ba6056367db58e93d4506263b71bd6f0

SHA256
4d29040978877a946f09c74fa94b1fcb0a5a58ec86b6e18546e1cf8803a3878f

SHA512
64192de602e119fd278e4ecc33c4e7a444875b93fd2e43f6037e85c15e1acbd942fa67c51402dbd7e6661dc93f76e2a41f1e543a344fa54a0a31ebd913027a89

Download Submit
memory/384-206-0x00000165D3220000-0x00000165D3234000-memory.dmp

Filesize
80KB

Download
memory/384-139-0x00000165BB0B0000-0x00000165BB0C4000-memory.dmp

Filesize
80KB

Download
memory/384-460-0x00000165D7730000-0x00000165D7C56000-memory.dmp

Filesize
5.1MB

Download
memory/384-473-0x00000165D5890000-0x00000165D589A000-memory.dmp

Filesize
40KB

Download
memory/384-318-0x00000165D5820000-0x00000165D5832000-memory.dmp

Filesize
72KB

Download
memory/384-149-0x00000165D3200000-0x00000165D321E000-memory.dmp

Filesize
120KB

Download
memory/384-279-0x00000165D57D0000-0x00000165D57F2000-memory.dmp

Filesize
136KB

Download
memory/384-214-0x00000165D3280000-0x00000165D328A000-memory.dmp

Filesize
40KB

Download
memory/384-207-0x00000165BB0A0000-0x00000165BB0AA000-memory.dmp

Filesize
40KB

Download
memory/384-122-0x00000165D3290000-0x00000165D3312000-memory.dmp

Filesize
520KB

Download
memory/384-474-0x00000165D6EA0000-0x00000165D6EB2000-memory.dmp

Filesize
72KB

Download
memory/384-125-0x00000165D5540000-0x00000165D5642000-memory.dmp

Filesize
1.0MB

Download
memory/384-459-0x00000165D7030000-0x00000165D71F2000-memory.dmp

Filesize
1.8MB

Download
memory/384-130-0x00000165D5650000-0x00000165D56C6000-memory.dmp

Filesize
472KB

Download
memory/384-123-0x00000165B9470000-0x00000165B9480000-memory.dmp

Filesize
64KB

Download
memory/384-124-0x00000165B94D0000-0x00000165B94F2000-memory.dmp

Filesize
136KB

Download
memory/600-1356-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/600-1028-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/1176-701-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/1176-819-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/1856-379-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-368-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-354-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-355-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-356-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-357-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-359-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-360-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-361-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-362-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-414-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-363-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-364-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-365-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-408-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-366-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-367-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-369-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-404-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-400-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-370-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-371-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-372-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-396-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-373-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-395-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-374-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-394-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-393-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-392-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-391-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-390-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-389-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-388-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-387-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-386-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-385-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-375-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-377-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-378-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-384-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-358-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-376-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-380-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-383-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-381-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/1856-382-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/2080-1040-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/2080-1359-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/2560-1076-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/2560-1362-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/3228-1300-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/3228-945-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/3388-415-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-405-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-402-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-403-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-417-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-406-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/3388-407-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-410-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-411-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-412-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-416-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-399-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-401-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-413-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-419-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-418-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-420-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3388-421-0x0000000077410000-0x000000007759E000-memory.dmp

Filesize
1.6MB

Download
memory/3584-1019-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/3584-792-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/3812-1401-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/3812-1463-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download