47dd3b96d620554569a957c1571b202f224a6ba2432cee71530613e1743fc0ac

Analysis

max time kernel
179s
max time network
182s
platform
windows10-1703_x64
resource
win10-20220812-es
resource tags

arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
04/01/2023, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SpotX-Win-main/scripts/Install_Basic.bat
Size

481B
MD5

4d2ee5ccf5bb96c40a93bc4b319a0bfd
SHA1

77c227f6f7bbab299ca5715944fe3a2b956b619e
SHA256

d0a556048b951afbdf89cef96a75cae184c9cf2817a26530c431015b66cd7799
SHA512

520142fcafe5290bc81da6d499fbdfc74a7a51db61c8726844bc1e81d110da855e22643334f577bd8be9630e9a129f2a496df356ac27d5c230031a7c4c42e954

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	2632	powershell.exe
4	2632	powershell.exe
6	2632	powershell.exe
8	2632	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
228	Spotify.exe
4124	Spotify.exe
2368	Spotify.exe
4652	Spotify.exe
4704	Spotify.exe
4136	Spotify.exe
432	Spotify.exe
3744	Spotify.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Control Panel\International\Geo\Nation	Spotify.exe

Loads dropped DLL 19 IoCs

pid	Process
4124	Spotify.exe
4124	Spotify.exe
2368	Spotify.exe
2368	Spotify.exe
4652	Spotify.exe
4652	Spotify.exe
4652	Spotify.exe
4652	Spotify.exe
4652	Spotify.exe
4652	Spotify.exe
4704	Spotify.exe
4652	Spotify.exe
4136	Spotify.exe
4136	Spotify.exe
4704	Spotify.exe
432	Spotify.exe
432	Spotify.exe
3744	Spotify.exe
3744	Spotify.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe
2632	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe
Token: SeCreatePagefilePrivilege	4124	Spotify.exe
Token: SeShutdownPrivilege	4124	Spotify.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4124	Spotify.exe
4124	Spotify.exe
4124	Spotify.exe
4124	Spotify.exe
4124	Spotify.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4124	Spotify.exe
4124	Spotify.exe
4124	Spotify.exe
4124	Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2632	2972	cmd.exe	67
PID 2972 wrote to memory of 2632	2972	cmd.exe	67
PID 2632 wrote to memory of 4968	2632	powershell.exe	70
PID 2632 wrote to memory of 4968	2632	powershell.exe	70
PID 1856 wrote to memory of 756	1856	explorer.exe	72
PID 1856 wrote to memory of 756	1856	explorer.exe	72
PID 1856 wrote to memory of 756	1856	explorer.exe	72
PID 756 wrote to memory of 228	756	SpotifySetup.exe	74
PID 756 wrote to memory of 228	756	SpotifySetup.exe	74
PID 756 wrote to memory of 228	756	SpotifySetup.exe	74
PID 2632 wrote to memory of 4124	2632	powershell.exe	77
PID 2632 wrote to memory of 4124	2632	powershell.exe	77
PID 2632 wrote to memory of 4124	2632	powershell.exe	77
PID 4124 wrote to memory of 2368	4124	Spotify.exe	78
PID 4124 wrote to memory of 2368	4124	Spotify.exe	78
PID 4124 wrote to memory of 2368	4124	Spotify.exe	78
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4652	4124	Spotify.exe	79
PID 4124 wrote to memory of 4704	4124	Spotify.exe	81
PID 4124 wrote to memory of 4704	4124	Spotify.exe	81
PID 4124 wrote to memory of 4704	4124	Spotify.exe	81
PID 4124 wrote to memory of 4704	4124	Spotify.exe	81
PID 4124 wrote to memory of 4704	4124	Spotify.exe	81
PID 4124 wrote to memory of 4704	4124	Spotify.exe	81
PID 4124 wrote to memory of 4704	4124	Spotify.exe	81
PID 4124 wrote to memory of 4704	4124	Spotify.exe	81
PID 4124 wrote to memory of 4704	4124	Spotify.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpotX-Win-main\scripts\Install_Basic.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "&{[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12}; """"& { $((Invoke-WebRequest -UseBasicParsing 'https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/Install.ps1').Content)} -confirm_uninstall_ms_spoti -confirm_spoti_recomended_over -podcasts_on -cache_off -block_update_off -exp_standart -hide_col_icon_off -start_spoti"""" | Invoke-Expression"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-01-04_14-59-04\SpotifySetup.exe
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.2.582 --initial-client-data=0x3f0,0x3f4,0x3f8,0x3d4,0x3fc,0x69aded00,0x69aded10,0x69aded1c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2368
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1564 --field-trial-handle=1744,i,12979771471560012241,16839485587603152744,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4652
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2428 --field-trial-handle=1744,i,12979771471560012241,16839485587603152744,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4704
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2444 --field-trial-handle=1744,i,12979771471560012241,16839485587603152744,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4136
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --first-renderer-process --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3396 --field-trial-handle=1744,i,12979771471560012241,16839485587603152744,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      PID:432
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1272 --field-trial-handle=1744,i,12979771471560012241,16839485587603152744,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3744

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-01-04_14-59-04\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-01-04_14-59-04\SpotifySetup.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    PID:228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
92bf038e1c9060904b63b21db17eab7e

SHA1
e854a64b2ad2d1da789b17941ad4a74e31326d0a

SHA256
47d18c66a5abf6a9182d62ace509339e6862cd1a5e744d31a660a1470de70279

SHA512
4f86c12fe780371bf66a2d23caa8d7a39906a74eb7765ee82d8e53fdbe762748956d8e49ff3c097800a4cbc754a58bfb2f2dac5e512ca3a69decec4a89722dc6

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
1.5MB

MD5
13e24f25cda69b8d22a24171ef824ef8

SHA1
b4fceabe143c01cb46254df27cb10244465f13d0

SHA256
82d9ef9b6a8e7fd48bcde8723a89d7b8efd6bf37c50364d2b9c848b7efacd524

SHA512
c18be0a26fc4788cbddc095c449f30ec24682bc79ce84f786fc508cb2c6a4e1803e6ce93fc986b3a5d91b0ef439e9539be27c51c186d4b542e5934f668427fef

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
1.3MB

MD5
ac829ec552f83d0a8193c0cd78e45641

SHA1
47bec5e0283f0055872f4d03da9d51eaac97d135

SHA256
f9ccf90846c914f355c620c58f0d3b99dba6661a60f07dd2bddd39e64436bdea

SHA512
58cdf9daa56261fac13e966b35244c0f759d09fe97b67329d79957a19c7a5bc3d07c5866177e66a2c3f40a03714c89d4d6cb8b7d5c2b373f5568c8ad107fdbeb

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll

Filesize
3.9MB

MD5
bce6d0f16abb8d6605ee69e889b37eb7

SHA1
037f19a44a5fa263c533e1185c8aa15200adf0ad

SHA256
67822622dc963c583530930e8011615ed7d1131911dcca493f6fbf443fa9d8c6

SHA512
9211b423135a76e97391f295e147668afad3dde84582450df6acce68bcd3ba79040cdb18f8375b5abb9d9d35692b5504ddbb64a2249b24c2996a9e9cfaf82ce0

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
600KB

MD5
22cffa11d298c474eb466547b5c0097b

SHA1
80d1a13cfeebc1c190838987bcbbec627f4b8c1a

SHA256
d785afc8953892615e480244010b5b25e364f51ef7410214dd883f1d8eb9532b

SHA512
a0df258f240317837314af43b5d9b6ff8b23d9e6a25a07cf6d1d5d26e678729fbd7857670378a879b973b568fd1dffd519ebd2e60e54ba9e26fab5333ae2b23b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
897KB

MD5
237a94cdebd069e219675e525b18a13a

SHA1
691bc1dda1d23e39efa8a25b289e0c4a6a5861ab

SHA256
0aa52b4ed48daaa75412f1a06cebf47fb1e03b5081e052a2f78034d725ce83ef

SHA512
dcfe0f4e4d458c419a245def6e0a972dcfc4bfb34e08865e72eceec87c28b0dd3f44bdc15d4e6ebb05f06d83cccee17158caacc35e564f2133b0524a8cf17d97

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
654B

MD5
c191f9ed1ae79d50e0b75f6d40375911

SHA1
cea54226f42cfbb83a3db9bad22474f4489f94a2

SHA256
d66bbe643943fb21a3c7e56a0b041bb010c6cb14cc4d5dd1f96eb889e341e7e9

SHA512
89d74342cc68d154733e6c4678ff5198b1f4033ff0a4be0c0aa64e2e74f39c2eff39cd8c1c9dfe716132d7b685d0694fbbfb5508ef507e3d2bab3fde296abb9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
25d87a2bb3581bc3597dfb9008516710

SHA1
e3f59f1de852cde2204256c7a8b1580483ab907a

SHA256
b75bd14a3d9a174ee44eca8c62b89c65d9836fcf62c28d103bfa300c02cef255

SHA512
59977fa5ec1dbda7cb6525c48655d6e8f3d7b00408e973efed1f2235d1d7fd88eae443fdd5e07d52f31ce83943aba050c31261baf2798c1b10aeae67981685ff

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll

Filesize
356KB

MD5
bf71eebc1b3a6f2a3a460ec40c0189a6

SHA1
beaeea459eb2a510a2644cc1c65b6993a4e782b7

SHA256
1db4b63469b1c31a2dc47915527a03132383b232d260e85cb8f2c8a4c5b3945a

SHA512
346077f696d87560c1ef7fa56c3a66bbcfa65dea3e0b0c5895db17e63581f5b26ae8e001b592d46b95a403a83ebde0a59e6fd2b51300d70584a5ea237fda777f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
5.4MB

MD5
e6f1df3cd185ee63fd0aa3decba3380d

SHA1
2c1da1115fe2f350e698680842aad008e5c77fa6

SHA256
5d13e04492f3ed595070ed3a1d48d29daf804ca02238ed0f2fef14865d1ce439

SHA512
72bf24071a2fc8324543a56561b8e401fa00757ebd2a01e320a1fdf6f31f876dd7465c392055a6162e1336b7e08d2b3c6ce0e197cfdda88370d8b84f4d8fbf95

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
337KB

MD5
f84dd97190589d26f5ae3721ff2e86f5

SHA1
a73ebc5bb9fba50141e9e399cd170db80de21bb8

SHA256
0cdf3bd5efe01c54962d382b90a670a747391e4e56d1b3e012bc207a292f564a

SHA512
727ca0321210dbab5384f33164b43e8490de837e837dec540480bddd4e899c551021a4500ba493c18513caefe7a875b5c4a6e33e3b4d07ff8f631ae1d07d576d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\es.mo

Filesize
14KB

MD5
0201c52b0aa81af14e438967c965c72c

SHA1
d6d2afe463ee8b05c7b53bd89471039cc273c340

SHA256
8331df25cd78028d98758444cdd9545b3cd6aa5579cc30c19e26e4e79d4c818a

SHA512
a780ce4ab1a64c64d008efc72c59568e3caea109884bf8cdc12bf11a648e814945f3a12defa355076bff5251b15b20ab99912fdbfd073d83b9a274e332a47cca

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
7.2MB

MD5
509c75095d1f285fcf14b152d7746d91

SHA1
5f75577267d44f97a15c9b7d75f289ca7bb8c0a2

SHA256
f76ec95f2fc27c20a4fd8d8dc0b6d17185617204bfbb21ae5269725d6a237c9a

SHA512
a1522f0b3f191e0f85c6d2faa641a6efa6e8dccc3f6ab489d4a2787949d4a9407d8c4065e0fb620a3eb7da7052351a1cccd50aa0be930e46b64f699aaf9e99af

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
590KB

MD5
fd33582b82e5b1e69d18ab4ea1ffad8e

SHA1
0aa2759a29c5592a7ca4170bc4f5bc679b8f66d6

SHA256
55680689bd6daef8d546a530c9dd069fcd560be68430653577118874fa0be8d3

SHA512
c46e656d6cb7b336681ab2f4170a911e13ef804c70ef05033dd64fa7cc8e910958a0be3056907c8330cdef0e5d11a3a5c9d1de9cffa5bade79f6a408f16af90a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
3.5MB

MD5
f1b7a423c6e9f302bd2410ca8842198a

SHA1
03dde3f2513e598650f5b12e8d5288f06410cb93

SHA256
bc9636ea5582f2bff2401c2d01e044eda9e20eec9404169737d388cd68a78840

SHA512
4670fdcb6bf5fac0d1622292bdfccf04b6de48e51be66ce854f32b78c996fc62316a034d37cf411a32f605ecf33a668d5189e6e225fd199c88122d8b490ab49d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll

Filesize
714KB

MD5
6d955287d7576f0ddd2f5a80ca6101c8

SHA1
421e8783ba6056367db58e93d4506263b71bd6f0

SHA256
4d29040978877a946f09c74fa94b1fcb0a5a58ec86b6e18546e1cf8803a3878f

SHA512
64192de602e119fd278e4ecc33c4e7a444875b93fd2e43f6037e85c15e1acbd942fa67c51402dbd7e6661dc93f76e2a41f1e543a344fa54a0a31ebd913027a89

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
bce6d0f16abb8d6605ee69e889b37eb7

SHA1
037f19a44a5fa263c533e1185c8aa15200adf0ad

SHA256
67822622dc963c583530930e8011615ed7d1131911dcca493f6fbf443fa9d8c6

SHA512
9211b423135a76e97391f295e147668afad3dde84582450df6acce68bcd3ba79040cdb18f8375b5abb9d9d35692b5504ddbb64a2249b24c2996a9e9cfaf82ce0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
356KB

MD5
bf71eebc1b3a6f2a3a460ec40c0189a6

SHA1
beaeea459eb2a510a2644cc1c65b6993a4e782b7

SHA256
1db4b63469b1c31a2dc47915527a03132383b232d260e85cb8f2c8a4c5b3945a

SHA512
346077f696d87560c1ef7fa56c3a66bbcfa65dea3e0b0c5895db17e63581f5b26ae8e001b592d46b95a403a83ebde0a59e6fd2b51300d70584a5ea237fda777f

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
5.4MB

MD5
e6f1df3cd185ee63fd0aa3decba3380d

SHA1
2c1da1115fe2f350e698680842aad008e5c77fa6

SHA256
5d13e04492f3ed595070ed3a1d48d29daf804ca02238ed0f2fef14865d1ce439

SHA512
72bf24071a2fc8324543a56561b8e401fa00757ebd2a01e320a1fdf6f31f876dd7465c392055a6162e1336b7e08d2b3c6ce0e197cfdda88370d8b84f4d8fbf95

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
146.0MB

MD5
527d37067ed4c3eeaa064aa2a152d481

SHA1
ea97b6d0f3c276ef8a3c50f3c199366c0ce2aa42

SHA256
53c58ba0e2122fafe8f5caf26494802a937d1cbecf43b61720f4b8f378ad91c7

SHA512
3486c28ebeaf43f9d0e33e7a493281549d5d246064c16abafa3ef7f73d69d46ab491a2684fa08f52193d95c80bb3c68ceee45047b2f4b074db572eae910200b0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
3.5MB

MD5
f1b7a423c6e9f302bd2410ca8842198a

SHA1
03dde3f2513e598650f5b12e8d5288f06410cb93

SHA256
bc9636ea5582f2bff2401c2d01e044eda9e20eec9404169737d388cd68a78840

SHA512
4670fdcb6bf5fac0d1622292bdfccf04b6de48e51be66ce854f32b78c996fc62316a034d37cf411a32f605ecf33a668d5189e6e225fd199c88122d8b490ab49d

Download Submit
\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll

Filesize
714KB

MD5
6d955287d7576f0ddd2f5a80ca6101c8

SHA1
421e8783ba6056367db58e93d4506263b71bd6f0

SHA256
4d29040978877a946f09c74fa94b1fcb0a5a58ec86b6e18546e1cf8803a3878f

SHA512
64192de602e119fd278e4ecc33c4e7a444875b93fd2e43f6037e85c15e1acbd942fa67c51402dbd7e6661dc93f76e2a41f1e543a344fa54a0a31ebd913027a89

Download Submit
memory/228-407-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-399-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-447-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/228-404-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-410-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-416-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-417-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-415-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-414-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-413-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-408-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-396-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-412-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-411-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-398-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-401-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/228-400-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/228-402-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/432-1324-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/432-1015-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/756-373-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-350-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-403-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-397-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-395-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-392-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-391-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-390-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-389-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-388-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-387-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-409-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-386-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-385-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-406-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-351-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-352-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-384-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-353-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-383-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-355-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-382-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-381-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-380-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-379-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-378-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-377-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-356-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-376-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-357-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-354-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-375-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-374-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-358-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-372-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-371-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-369-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-370-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-368-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-359-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-367-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-361-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-360-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-363-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-366-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-365-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-362-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/756-364-0x0000000077890000-0x0000000077A1E000-memory.dmp

Filesize
1.6MB

Download
memory/2368-758-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/2368-949-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/2632-315-0x00000173AF6E0000-0x00000173AF6F2000-memory.dmp

Filesize
72KB

Download
memory/2632-204-0x0000017397010000-0x000001739701A000-memory.dmp

Filesize
40KB

Download
memory/2632-146-0x0000017396FF0000-0x000001739700E000-memory.dmp

Filesize
120KB

Download
memory/2632-123-0x00000173AF2B0000-0x00000173AF332000-memory.dmp

Filesize
520KB

Download
memory/2632-124-0x0000017396F40000-0x0000017396F62000-memory.dmp

Filesize
136KB

Download
memory/2632-276-0x00000173AF260000-0x00000173AF282000-memory.dmp

Filesize
136KB

Download
memory/2632-125-0x0000017396AC0000-0x0000017396AD0000-memory.dmp

Filesize
64KB

Download
memory/2632-211-0x00000173AF230000-0x00000173AF23A000-memory.dmp

Filesize
40KB

Download
memory/2632-203-0x00000173AF1B0000-0x00000173AF1C4000-memory.dmp

Filesize
80KB

Download
memory/2632-463-0x00000173B0090000-0x00000173B00A2000-memory.dmp

Filesize
72KB

Download
memory/2632-462-0x00000173AF440000-0x00000173AF44A000-memory.dmp

Filesize
40KB

Download
memory/2632-449-0x00000173B0940000-0x00000173B0E66000-memory.dmp

Filesize
5.1MB

Download
memory/2632-448-0x00000173B0240000-0x00000173B0402000-memory.dmp

Filesize
1.8MB

Download
memory/2632-126-0x00000173AF450000-0x00000173AF552000-memory.dmp

Filesize
1.0MB

Download
memory/2632-129-0x00000173AF560000-0x00000173AF5D6000-memory.dmp

Filesize
472KB

Download
memory/2632-136-0x0000017396FD0000-0x0000017396FE4000-memory.dmp

Filesize
80KB

Download
memory/3744-1357-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/3744-1426-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4124-685-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4124-768-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4136-1323-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4136-999-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4652-1271-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4652-907-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4704-1308-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4704-961-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download