lumma | fbcc321f10e8ed9fbda3e9d9ce6cc03ad1fa3c83578a2b22ec7f6fd853412750

Analysis

max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2023 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp/SpotifySetup (6).exe
Size

901KB
MD5

6b4411127459dc891fc2fdecbf02ad23
SHA1

b3904dd4f88ec6fce4f806eef1acad40c75e68b8
SHA256

c85f5e46a80bf8658245f7409318a3e1a6894c5de5cfe321c0b1edb13a5e81e4
SHA512

b075b9a2d6b6573627afcd4112da3cb081204169e59172f16de8c8ac7c7ad3a1ae809e9252c58094dbfdb16b9b48c1b032b18397acfc372fa0487271feee77c0
SSDEEP

24576:bL3ZLvFFzsZ1nMdwOySKcgwkPIBu9mI+kVluU:bL3lsfMdwOySKkkPIY9z+kXj

Score

10^/10

lumma discovery persistence stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Spotify.exeSpotify.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 9 IoCs

Processes:

SpWebInst0.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exe

pid process

3432 SpWebInst0.exe
5028 Spotify.exe
1172 Spotify.exe
2676 Spotify.exe
1896 Spotify.exe
3124 Spotify.exe
1372 Spotify.exe
1020 Spotify.exe
1100 Spotify.exe

pid	process
3432	SpWebInst0.exe
5028	Spotify.exe
1172	Spotify.exe
2676	Spotify.exe
1896	Spotify.exe
3124	Spotify.exe
1372	Spotify.exe
1020	Spotify.exe
1100	Spotify.exe

Loads dropped DLL 22 IoCs

Processes:

Spotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exe

pid	process
5028	Spotify.exe
5028	Spotify.exe
1172	Spotify.exe
1172	Spotify.exe
2676	Spotify.exe
2676	Spotify.exe
3124	Spotify.exe
3124	Spotify.exe
2676	Spotify.exe
2676	Spotify.exe
2676	Spotify.exe
2676	Spotify.exe
1896	Spotify.exe
1896	Spotify.exe
2676	Spotify.exe
1372	Spotify.exe
1372	Spotify.exe
1020	Spotify.exe
1020	Spotify.exe
1100	Spotify.exe
1100	Spotify.exe
1100	Spotify.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

Processes:

Spotify.exe

description	ioc	process
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping5028_169863047\manifest.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping5028_169863047\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping5028_169863047\manifest.fingerprint	Spotify.exe
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping5028_169863047\_platform_specific\win_x86\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping5028_169863047\_platform_specific\win_x86\widevinecdm.dll	Spotify.exe
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping5028_169863047\LICENSE	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe

Modifies registry class 36 IoCs

Processes:

SearchApp.exeSpotify.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Spotify.exe

pid process

1100 Spotify.exe
1100 Spotify.exe

pid	process
1100	Spotify.exe
1100	Spotify.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Spotify.exe

description	pid	process
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe
Token: SeShutdownPrivilege	5028	Spotify.exe
Token: SeCreatePagefilePrivilege	5028	Spotify.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Spotify.exe

pid process

5028 Spotify.exe
5028 Spotify.exe
5028 Spotify.exe
5028 Spotify.exe
5028 Spotify.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Spotify.exe

pid process

5028 Spotify.exe
5028 Spotify.exe
5028 Spotify.exe
5028 Spotify.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

SearchApp.exe

pid process

1972 SearchApp.exe

pid	process
1972	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SpotifySetup (6).exeSpWebInst0.exeSpotify.exe

description	pid	process	target process
PID 5052 wrote to memory of 3432	5052	SpotifySetup (6).exe	SpWebInst0.exe
PID 5052 wrote to memory of 3432	5052	SpotifySetup (6).exe	SpWebInst0.exe
PID 5052 wrote to memory of 3432	5052	SpotifySetup (6).exe	SpWebInst0.exe
PID 3432 wrote to memory of 5028	3432	SpWebInst0.exe	Spotify.exe
PID 3432 wrote to memory of 5028	3432	SpWebInst0.exe	Spotify.exe
PID 3432 wrote to memory of 5028	3432	SpWebInst0.exe	Spotify.exe
PID 5028 wrote to memory of 1172	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1172	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1172	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 2676	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe
PID 5028 wrote to memory of 1896	5028	Spotify.exe	Spotify.exe

C:\Users\Admin\AppData\Local\Temp\tmp\SpotifySetup (6).exe
"C:\Users\Admin\AppData\Local\Temp\tmp\SpotifySetup (6).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5052

C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
SpWebInst0.exe /webinstall
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Spotify.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.8.923 --initial-client-data=0x468,0x46c,0x470,0x464,0x474,0x68dbc0c0,0x68dbc0d0,0x68dbc0dc
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/111.0.5563.65 Spotify/1.2.8.923" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1740 --field-trial-handle=1884,i,15019682201964466655,9141801009296655034,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/111.0.5563.65 Spotify/1.2.8.923" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3032 --field-trial-handle=1884,i,15019682201964466655,9141801009296655034,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/111.0.5563.65 Spotify/1.2.8.923" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --first-renderer-process --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3936 --field-trial-handle=1884,i,15019682201964466655,9141801009296655034,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1372

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/111.0.5563.65 Spotify/1.2.8.923" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3092 --field-trial-handle=1884,i,15019682201964466655,9141801009296655034,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3124

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/111.0.5563.65 Spotify/1.2.8.923" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=4416 --field-trial-handle=1884,i,15019682201964466655,9141801009296655034,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/111.0.5563.65 Spotify/1.2.8.923" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1372 --field-trial-handle=1884,i,15019682201964466655,9141801009296655034,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3900

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\4bb8579f10994729a23e0cbc9dce8854 /t 3856 /p 3816
1⤵
PID:3600

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping5028_169863047\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping5028_169863047\manifest.json

Filesize
984B

MD5
59741ca0b4ed8f06f8984e5c91747a4a

SHA1
334c396dd6e710de0e5b82b93cfaba764abc0331

SHA256
8dabab92309c13bbbf130183e757967bb1d80b47d06d678d12bd7009bc4e0dd7

SHA512
9ff5db978545120a033f5899444cfce08fbb3bb68afd3ca4be394adf781f42c8689c3a2a3d929c0d391a7902315e2073509eb5f8344b96e186b1a63f35d565c8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133249945037332026.txt

Filesize
76KB

MD5
40a3bfdbe8f5f9ce2ccb1b9e5bc64eef

SHA1
118d18bdd5f9e99dba89867f5aa9f1dfd5e63632

SHA256
ade8bb612d2fc4e155b67dbb2bf018ff24b41044ce7d5788e82f251286869f0c

SHA512
0f3f27c76ed7c429a49b9da12920cd55d24f55befcc9f7efccd94a64bfd9bbff13d6bd1b51e8ba41017f2b8cc47ddd91d72c159d828b75c385d7b1ce1ccab52f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
43e07b8b3f57455231d9aaf0e5c43493

SHA1
ac9c014abc8a2c7f656c3aad62bed983d268f933

SHA256
c54604ca702e38ccfb06dcb1ef6c4544c4cd332cf3cf973b3492f5934bb9b746

SHA512
bef59d69044247229b27b1b1e4a5fe1e545f4f32d63e699f54e98be39b42e5b778adf74f1589e044359ad7487d935612856036ca1d39d43f8620cefe27b19b0b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
a815243cc8e70a87bae4865f981487ca

SHA1
3d3ceb9038c516e6200148136b5026e01299e1bc

SHA256
28b6e024c531c9cac0fbfa7844fd1d0ecde0748a447f88ef7d6c632f8c2f268a

SHA512
ffc7dd81476f2d3de6eca60e37f468419002bf8dc14c5ffd8ff64c5e6f873dd0e0439b99763ca00a093ae96188897310414a2ba39a93e1a147fdd98a22efcb25

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State

Filesize
1KB

MD5
3bcc0fa6b5c043b084cc2fe2360d700d

SHA1
7103b4505af64a1aabbd07380a3fdb4ddd2c7b49

SHA256
f56cd82e610bcabfbfcee8ecdb66a5da37a47e1eef24222891a55389430d0701

SHA512
c68f55d764cff27ab57ab63061490028c6521dddde2442c530befc275b8f983b74e964492b92a930899fc93b35b47934bc8512f37b04e336ded492f1d7785ee4

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe58a39e.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity

Filesize
692B

MD5
a3ef49a78a7166aa6bf4fbc515d920b3

SHA1
566f6357a1ff88fb59f75a403295b9f0b045731f

SHA256
7f9c45c2752632fc1ebb896c233932a6e594d203dab57f60407d81ff0e431639

SHA512
b21e08bbbe479fa4abdce55d86d623f31aa3e508e72d242da46c97a12900ea9489aee8ae1fac5fd787c058199dc8c20716c3fef37ce7bf7009282f8f446f7c66

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity~RFe57ee29.TMP

Filesize
524B

MD5
5719cb23d003b649ca49403a8b0102db

SHA1
1f1a24c485d5838b1ebfa56b14d75711903626c7

SHA256
84f9d182532b8fc7980fca9f709f29b6f41b63765589e27e011577cac21bd465

SHA512
7f7aa423088cb178a4454691de495014b28b099becc4067d8c44c7ee9116ad84faabb0783515938a4e3cc78f816402af0cc12e8ef960afaac851ba911c9acc2b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
780B

MD5
148abf3744ece9797648e02882a7f19b

SHA1
6d4c24caa84b7982682f55b459790c1af0c826f6

SHA256
aa92463a6712acdf91d060f1d115052bbf642d625b75ff67dfff317862ac4464

SHA512
b42a9dce3e72357f9ea78f1fe10a6ae162c70aaa06174080d378f7a0ba115b645f65fc0d72bc80d5b51f2775a9e9ed4626f07a1249cc19aae48daf2a55ab7c77

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
687B

MD5
c75f569d5b4a4ee92789875a69e377b8

SHA1
b76cfa0dccf0793d5838a127c76fe79c3681f546

SHA256
f5013dfd16ce37947af52de1c592c8faa5a52018804dc9b8e3dea030f5c3b3ba

SHA512
255d6c874afef66404c05a7851b9cf96419912b0973a24340bf217963934d63691d46b07ce53496fe1e7654db4c3d56ba0081b97ada8fadb492c32115ecc3dde

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe57aa1b.TMP

Filesize
484B

MD5
7c3edd11e5b78880729bc98d0a965b82

SHA1
be61a9a3443e614ab1bb7dfde5f7eef89a521512

SHA256
2469c4e9f659465088d18aaf58952d54c55358ca723009b3bb37d339c0ba52a1

SHA512
50804430f8b75e2c4492fe0e0c5761df254895f0d9ddca9a60283ce0b3e59ff7fddc7c590ab6e827cadecd8b17256388d301f848d362ca22373fbd01842d1e6c

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
3dbf99bbb72903ecb0c5b427d925cc8e

SHA1
90032e0dff6c2bb61ffde1f1c9722c66afb6078c

SHA256
b58847781b74627debbc7f455964ec4794035fd0e669e50f741c3e4d29da3977

SHA512
f8336665e4c37ea29fbfeec786299deb3f7bc3a296e31cdb640495b0f637dbae1f3dcb2a955226d0c46e0d9c042e299ced4a59c028aeec589b85c941282037a1

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
1.5MB

MD5
74353c5b79b84c99153c3e9398405f2f

SHA1
05f485bb8e1eebe5da225ff96b4830b4d80728c9

SHA256
b0d5e7303af761801f03caa804f44aed9662d6dd83dfba188efbd39ec54592e1

SHA512
8501aa70392b74aaf53ddb10a45b79cace30fef26109acf4fa6e99179903fdaef2a18cae1cd2de4884a5cc25f32bdd57c83b72ab8f1760b1710de261d7c5455d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll

Filesize
3.9MB

MD5
10f4f94bb2fed0034c8432df5ddbd1d1

SHA1
2bbba48cfe2e6e2c7899e52ee8f081622c799cde

SHA256
286a8cb18d100d7f50a591c54f446320f685f1713844c5189b727af5530d0eb1

SHA512
ff9ce3d1120c1eca90dea584925de6e10060d20ac667d2191f2bf704049b9ab9bb098fcd3dc67ad617ef9c2c76910a36673b34b4f5596e7daf9b9b2ce41673fe

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe

Filesize
83.7MB

MD5
83e5f52a391d48afcd6639ba656ab171

SHA1
8c8e84ecf51de368d39f24521b69e95beba62471

SHA256
84d09d341f412796e77587154eb81626c7067a856e2031d64583b6d9ec5ae8c4

SHA512
053fb6b616ec2016f0d334d7deae1ee78081a9921b5f5040a5a7cd5d1f1878b41f1e7e8193e2f6b0339c51d98f1e1a802412379fc9480f227b10b72bb984bb45

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe

Filesize
83.7MB

MD5
83e5f52a391d48afcd6639ba656ab171

SHA1
8c8e84ecf51de368d39f24521b69e95beba62471

SHA256
84d09d341f412796e77587154eb81626c7067a856e2031d64583b6d9ec5ae8c4

SHA512
053fb6b616ec2016f0d334d7deae1ee78081a9921b5f5040a5a7cd5d1f1878b41f1e7e8193e2f6b0339c51d98f1e1a802412379fc9480f227b10b72bb984bb45

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.5MB

MD5
aabcdd3d8551e87316bdcf013ce69daf

SHA1
cbccb8660f6c7a4cca5b00db4547dab24ff24d5d

SHA256
c38835b9ec23cfa843b961966aa79b297d109b6f755af108e6a5c856243f91e5

SHA512
097c9a21793ad7593e38936692ba14af26e88939fd8dd52a71697d8ef0b747eb62180cef463de1c9e473c664b1361b6648f8d91b9cb28219d56e9776fe2017ac

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.5MB

MD5
aabcdd3d8551e87316bdcf013ce69daf

SHA1
cbccb8660f6c7a4cca5b00db4547dab24ff24d5d

SHA256
c38835b9ec23cfa843b961966aa79b297d109b6f755af108e6a5c856243f91e5

SHA512
097c9a21793ad7593e38936692ba14af26e88939fd8dd52a71697d8ef0b747eb62180cef463de1c9e473c664b1361b6648f8d91b9cb28219d56e9776fe2017ac

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.5MB

MD5
aabcdd3d8551e87316bdcf013ce69daf

SHA1
cbccb8660f6c7a4cca5b00db4547dab24ff24d5d

SHA256
c38835b9ec23cfa843b961966aa79b297d109b6f755af108e6a5c856243f91e5

SHA512
097c9a21793ad7593e38936692ba14af26e88939fd8dd52a71697d8ef0b747eb62180cef463de1c9e473c664b1361b6648f8d91b9cb28219d56e9776fe2017ac

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.5MB

MD5
aabcdd3d8551e87316bdcf013ce69daf

SHA1
cbccb8660f6c7a4cca5b00db4547dab24ff24d5d

SHA256
c38835b9ec23cfa843b961966aa79b297d109b6f755af108e6a5c856243f91e5

SHA512
097c9a21793ad7593e38936692ba14af26e88939fd8dd52a71697d8ef0b747eb62180cef463de1c9e473c664b1361b6648f8d91b9cb28219d56e9776fe2017ac

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.5MB

MD5
aabcdd3d8551e87316bdcf013ce69daf

SHA1
cbccb8660f6c7a4cca5b00db4547dab24ff24d5d

SHA256
c38835b9ec23cfa843b961966aa79b297d109b6f755af108e6a5c856243f91e5

SHA512
097c9a21793ad7593e38936692ba14af26e88939fd8dd52a71697d8ef0b747eb62180cef463de1c9e473c664b1361b6648f8d91b9cb28219d56e9776fe2017ac

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.5MB

MD5
aabcdd3d8551e87316bdcf013ce69daf

SHA1
cbccb8660f6c7a4cca5b00db4547dab24ff24d5d

SHA256
c38835b9ec23cfa843b961966aa79b297d109b6f755af108e6a5c856243f91e5

SHA512
097c9a21793ad7593e38936692ba14af26e88939fd8dd52a71697d8ef0b747eb62180cef463de1c9e473c664b1361b6648f8d91b9cb28219d56e9776fe2017ac

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.5MB

MD5
aabcdd3d8551e87316bdcf013ce69daf

SHA1
cbccb8660f6c7a4cca5b00db4547dab24ff24d5d

SHA256
c38835b9ec23cfa843b961966aa79b297d109b6f755af108e6a5c856243f91e5

SHA512
097c9a21793ad7593e38936692ba14af26e88939fd8dd52a71697d8ef0b747eb62180cef463de1c9e473c664b1361b6648f8d91b9cb28219d56e9776fe2017ac

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.5MB

MD5
aabcdd3d8551e87316bdcf013ce69daf

SHA1
cbccb8660f6c7a4cca5b00db4547dab24ff24d5d

SHA256
c38835b9ec23cfa843b961966aa79b297d109b6f755af108e6a5c856243f91e5

SHA512
097c9a21793ad7593e38936692ba14af26e88939fd8dd52a71697d8ef0b747eb62180cef463de1c9e473c664b1361b6648f8d91b9cb28219d56e9776fe2017ac

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.5MB

MD5
aabcdd3d8551e87316bdcf013ce69daf

SHA1
cbccb8660f6c7a4cca5b00db4547dab24ff24d5d

SHA256
c38835b9ec23cfa843b961966aa79b297d109b6f755af108e6a5c856243f91e5

SHA512
097c9a21793ad7593e38936692ba14af26e88939fd8dd52a71697d8ef0b747eb62180cef463de1c9e473c664b1361b6648f8d91b9cb28219d56e9776fe2017ac

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
597KB

MD5
4e87aebd544b44b71e96b8b21c86de12

SHA1
348cadaa3e0a4f77ee9463f329f090a588697634

SHA256
0140f9a1019bd7e1dce5043e32228d235cbfafb46f4b9a93d7c53e87c108ff4d

SHA512
6cee4ea73704c21fffd40f093094352f24ffe3633eb62001536c745499ef9717346612b4e1a763d6d010d40719bf22b619acdd440efa6300eada156b20bfe63e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
893KB

MD5
747d98cc5e8e198bd5fab77edccc9d63

SHA1
76dd043bbecdcc2ede82cae72052554186539c2f

SHA256
d5ed68106e154ca0587583a34eb0fd71f82df60c543e458b0aa8f9422ac032fc

SHA512
5a18ba68c7af982ba6cfe0e9f59f30de914b9f7850260878fd1e4b4feef7e7975217ee57140b29accfe9429727e4b21fd3dcab5cbd670046915be3b876a4b610

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
5cbdb647ed0f9e0fecc924f7733bbe95

SHA1
0b4b73cde6ca3dbf218aa04468d4490009a84ab6

SHA256
0b393f576c73c247aca4f5f784fe9065508615d911c529f8f63b746ba5f1f102

SHA512
6807aed148d80b8abab0fd6925b8ddcb5be110caf9a8f6a0ebb449c9bfb633171f4714d83a9c506ed2161dd873bd3004ee3f3f5262ec01d0d4a93611083268c9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
5cbdb647ed0f9e0fecc924f7733bbe95

SHA1
0b4b73cde6ca3dbf218aa04468d4490009a84ab6

SHA256
0b393f576c73c247aca4f5f784fe9065508615d911c529f8f63b746ba5f1f102

SHA512
6807aed148d80b8abab0fd6925b8ddcb5be110caf9a8f6a0ebb449c9bfb633171f4714d83a9c506ed2161dd873bd3004ee3f3f5262ec01d0d4a93611083268c9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
5cbdb647ed0f9e0fecc924f7733bbe95

SHA1
0b4b73cde6ca3dbf218aa04468d4490009a84ab6

SHA256
0b393f576c73c247aca4f5f784fe9065508615d911c529f8f63b746ba5f1f102

SHA512
6807aed148d80b8abab0fd6925b8ddcb5be110caf9a8f6a0ebb449c9bfb633171f4714d83a9c506ed2161dd873bd3004ee3f3f5262ec01d0d4a93611083268c9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
5cbdb647ed0f9e0fecc924f7733bbe95

SHA1
0b4b73cde6ca3dbf218aa04468d4490009a84ab6

SHA256
0b393f576c73c247aca4f5f784fe9065508615d911c529f8f63b746ba5f1f102

SHA512
6807aed148d80b8abab0fd6925b8ddcb5be110caf9a8f6a0ebb449c9bfb633171f4714d83a9c506ed2161dd873bd3004ee3f3f5262ec01d0d4a93611083268c9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
5cbdb647ed0f9e0fecc924f7733bbe95

SHA1
0b4b73cde6ca3dbf218aa04468d4490009a84ab6

SHA256
0b393f576c73c247aca4f5f784fe9065508615d911c529f8f63b746ba5f1f102

SHA512
6807aed148d80b8abab0fd6925b8ddcb5be110caf9a8f6a0ebb449c9bfb633171f4714d83a9c506ed2161dd873bd3004ee3f3f5262ec01d0d4a93611083268c9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
5cbdb647ed0f9e0fecc924f7733bbe95

SHA1
0b4b73cde6ca3dbf218aa04468d4490009a84ab6

SHA256
0b393f576c73c247aca4f5f784fe9065508615d911c529f8f63b746ba5f1f102

SHA512
6807aed148d80b8abab0fd6925b8ddcb5be110caf9a8f6a0ebb449c9bfb633171f4714d83a9c506ed2161dd873bd3004ee3f3f5262ec01d0d4a93611083268c9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
5cbdb647ed0f9e0fecc924f7733bbe95

SHA1
0b4b73cde6ca3dbf218aa04468d4490009a84ab6

SHA256
0b393f576c73c247aca4f5f784fe9065508615d911c529f8f63b746ba5f1f102

SHA512
6807aed148d80b8abab0fd6925b8ddcb5be110caf9a8f6a0ebb449c9bfb633171f4714d83a9c506ed2161dd873bd3004ee3f3f5262ec01d0d4a93611083268c9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
5cbdb647ed0f9e0fecc924f7733bbe95

SHA1
0b4b73cde6ca3dbf218aa04468d4490009a84ab6

SHA256
0b393f576c73c247aca4f5f784fe9065508615d911c529f8f63b746ba5f1f102

SHA512
6807aed148d80b8abab0fd6925b8ddcb5be110caf9a8f6a0ebb449c9bfb633171f4714d83a9c506ed2161dd873bd3004ee3f3f5262ec01d0d4a93611083268c9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
5cbdb647ed0f9e0fecc924f7733bbe95

SHA1
0b4b73cde6ca3dbf218aa04468d4490009a84ab6

SHA256
0b393f576c73c247aca4f5f784fe9065508615d911c529f8f63b746ba5f1f102

SHA512
6807aed148d80b8abab0fd6925b8ddcb5be110caf9a8f6a0ebb449c9bfb633171f4714d83a9c506ed2161dd873bd3004ee3f3f5262ec01d0d4a93611083268c9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
654B

MD5
11ad46b00651a2f6c265cf1727832b55

SHA1
49f46d17c04d2e1502833248594a9b7b6b786c78

SHA256
04e48ccb8b2bb2d475f7b5721ef365d4e521a28d7af84f95264be82f4d45b1b7

SHA512
af0265a8f4b7ddb9973248b9e83bfdf721805ed26047989e33552b640d8674a2d7c2b55f4e3439eca767358acb58a356eba2a49ff80c4903ce9184305909a59c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
10f4f94bb2fed0034c8432df5ddbd1d1

SHA1
2bbba48cfe2e6e2c7899e52ee8f081622c799cde

SHA256
286a8cb18d100d7f50a591c54f446320f685f1713844c5189b727af5530d0eb1

SHA512
ff9ce3d1120c1eca90dea584925de6e10060d20ac667d2191f2bf704049b9ab9bb098fcd3dc67ad617ef9c2c76910a36673b34b4f5596e7daf9b9b2ce41673fe

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.1MB

MD5
d89ce8c00659d8e5d408c696ee087ce3

SHA1
49fc8109960be3bb32c06c3d1256cb66dded19a8

SHA256
9dfbe0dad5c7021cfe8df7f52458c422cbc5be9e16ff33ec90665bb1e3f182de

SHA512
db097ce3eb9e132d0444df79b167a7dcb2df31effbbd3df72da3d24ae2230cc5213c6df5e575985a9918fbd0a6576e335b6ebc12b6258bc93fa205399de64c37

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
372KB

MD5
dd1343b878a79f6f428d87fe5b21b32c

SHA1
f300027e868435ce97533585612d818bbdf97d9c

SHA256
e564633e6aeafb2010b25f29819fa8a6703eb82f5e038fec0a96697e48aa0c2f

SHA512
92703d8d1e3ae7f73a73b9910aad64e51f7ae17185e9c3acb29383375b6003bb56297c93db359956860494251b9ef92ce5fd0a95db4030a1ed485ae5488900e9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
6.3MB

MD5
7a81b3b28bd065c832e67d7c9bf36106

SHA1
744a94b717c243834ca243e51df23ddba41b5355

SHA256
531840152e094fb4d32bac6b22bc19e66329a3fd474e4fae8c550312e90657d1

SHA512
79e87775f5afd0351e9074b4cde349f9bf1279bc5e6c9578fbaba84ab01e26b978c50515d3145c8dd317babee5e24fa23b98efa554d062372041ac04a3d119cc

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
158.2MB

MD5
2cca7463b6c998f2573b43a9888aff8c

SHA1
015482d13dc04d9d4e3d0e159dad9005437f1df0

SHA256
44bb228f3fd9a899fe2e46130d939d753c05bcec69b3b6a7d91446fcf30d7973

SHA512
4162d99f3425d551da0e4b14999e0b726b6e24d007635fee3376d61f63ced77006f97ee69e51626469b1ed4fbde6b0cfdb80527282f3891662de79f4d726c855

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
158.2MB

MD5
2cca7463b6c998f2573b43a9888aff8c

SHA1
015482d13dc04d9d4e3d0e159dad9005437f1df0

SHA256
44bb228f3fd9a899fe2e46130d939d753c05bcec69b3b6a7d91446fcf30d7973

SHA512
4162d99f3425d551da0e4b14999e0b726b6e24d007635fee3376d61f63ced77006f97ee69e51626469b1ed4fbde6b0cfdb80527282f3891662de79f4d726c855

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
158.2MB

MD5
2cca7463b6c998f2573b43a9888aff8c

SHA1
015482d13dc04d9d4e3d0e159dad9005437f1df0

SHA256
44bb228f3fd9a899fe2e46130d939d753c05bcec69b3b6a7d91446fcf30d7973

SHA512
4162d99f3425d551da0e4b14999e0b726b6e24d007635fee3376d61f63ced77006f97ee69e51626469b1ed4fbde6b0cfdb80527282f3891662de79f4d726c855

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
158.2MB

MD5
2cca7463b6c998f2573b43a9888aff8c

SHA1
015482d13dc04d9d4e3d0e159dad9005437f1df0

SHA256
44bb228f3fd9a899fe2e46130d939d753c05bcec69b3b6a7d91446fcf30d7973

SHA512
4162d99f3425d551da0e4b14999e0b726b6e24d007635fee3376d61f63ced77006f97ee69e51626469b1ed4fbde6b0cfdb80527282f3891662de79f4d726c855

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
158.2MB

MD5
2cca7463b6c998f2573b43a9888aff8c

SHA1
015482d13dc04d9d4e3d0e159dad9005437f1df0

SHA256
44bb228f3fd9a899fe2e46130d939d753c05bcec69b3b6a7d91446fcf30d7973

SHA512
4162d99f3425d551da0e4b14999e0b726b6e24d007635fee3376d61f63ced77006f97ee69e51626469b1ed4fbde6b0cfdb80527282f3891662de79f4d726c855

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
158.2MB

MD5
2cca7463b6c998f2573b43a9888aff8c

SHA1
015482d13dc04d9d4e3d0e159dad9005437f1df0

SHA256
44bb228f3fd9a899fe2e46130d939d753c05bcec69b3b6a7d91446fcf30d7973

SHA512
4162d99f3425d551da0e4b14999e0b726b6e24d007635fee3376d61f63ced77006f97ee69e51626469b1ed4fbde6b0cfdb80527282f3891662de79f4d726c855

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
158.2MB

MD5
2cca7463b6c998f2573b43a9888aff8c

SHA1
015482d13dc04d9d4e3d0e159dad9005437f1df0

SHA256
44bb228f3fd9a899fe2e46130d939d753c05bcec69b3b6a7d91446fcf30d7973

SHA512
4162d99f3425d551da0e4b14999e0b726b6e24d007635fee3376d61f63ced77006f97ee69e51626469b1ed4fbde6b0cfdb80527282f3891662de79f4d726c855

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
158.2MB

MD5
2cca7463b6c998f2573b43a9888aff8c

SHA1
015482d13dc04d9d4e3d0e159dad9005437f1df0

SHA256
44bb228f3fd9a899fe2e46130d939d753c05bcec69b3b6a7d91446fcf30d7973

SHA512
4162d99f3425d551da0e4b14999e0b726b6e24d007635fee3376d61f63ced77006f97ee69e51626469b1ed4fbde6b0cfdb80527282f3891662de79f4d726c855

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
158.2MB

MD5
2cca7463b6c998f2573b43a9888aff8c

SHA1
015482d13dc04d9d4e3d0e159dad9005437f1df0

SHA256
44bb228f3fd9a899fe2e46130d939d753c05bcec69b3b6a7d91446fcf30d7973

SHA512
4162d99f3425d551da0e4b14999e0b726b6e24d007635fee3376d61f63ced77006f97ee69e51626469b1ed4fbde6b0cfdb80527282f3891662de79f4d726c855

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll

Filesize
372KB

MD5
dd1343b878a79f6f428d87fe5b21b32c

SHA1
f300027e868435ce97533585612d818bbdf97d9c

SHA256
e564633e6aeafb2010b25f29819fa8a6703eb82f5e038fec0a96697e48aa0c2f

SHA512
92703d8d1e3ae7f73a73b9910aad64e51f7ae17185e9c3acb29383375b6003bb56297c93db359956860494251b9ef92ce5fd0a95db4030a1ed485ae5488900e9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
6.3MB

MD5
7a81b3b28bd065c832e67d7c9bf36106

SHA1
744a94b717c243834ca243e51df23ddba41b5355

SHA256
531840152e094fb4d32bac6b22bc19e66329a3fd474e4fae8c550312e90657d1

SHA512
79e87775f5afd0351e9074b4cde349f9bf1279bc5e6c9578fbaba84ab01e26b978c50515d3145c8dd317babee5e24fa23b98efa554d062372041ac04a3d119cc

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
374KB

MD5
d2d04d28417ce1630dfd86ba322c71f8

SHA1
5e252cbdb362cf286247b703468f637733bd9798

SHA256
3e5d289c59de9d451e34ec5a0c41621addb6583881b6cd732d89b0f42e94da70

SHA512
e609c9c1d7e065ab931d58e63f92ab99c56ae6332f9eb7a99fd3b77759b13265e7fb5cb69044d5cae16e8d5995279ddd0c2dba4f346ee8254c5d39f5dcc5841f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
13KB

MD5
159d3901f386388df374566fb6fcd622

SHA1
7ef0b2b651a7bdcba44efafb5e67b922d447f198

SHA256
e531925d86eb4f14ff09675bebce21a5ab6301ab139052f0514752e8ea346a19

SHA512
c951416ccfca17a533719e00d244844469a35dd7c6b1b21ad24daa400881b265750d97039c7e7f37e5d058b92402b1a016ca57315adb89627e0692330bc3282f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
7.4MB

MD5
d549a3ab7e64ee9740a40901c537da29

SHA1
6abdd145bee35f1ee9698f97a6db48a0d94c7680

SHA256
88776bb40d51e520c8cf47f59e865d0b36394e39766f3156066fa9840381fffc

SHA512
6596d01ad6472a34be3020d752e31ad805cf2592ccbb78fd536544c0dbce02b54bac2039eda82133788ed5c3659de35bee02951519c2e14f8d9cccb7da4eb8ac

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
446KB

MD5
89f8e1d65fdd2aee6c7aa08c98468aea

SHA1
0bb9c835b7b6610da1f7d6689f9ab23c4da5d454

SHA256
90c4d2488c1c3458e007fd1d37c558a2fc6d8a11e90403e1d807f33c5ba18082

SHA512
18cb091f2c71edf0b0c570b10b5a2a76df28f3800df40725a5abb5650d533f69e2ee8f9d081d34db1517f910472713f05826b8b652cbc4bc3d6a1ba29bc3e73e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.3MB

MD5
e2a9266e6d07d315ef9ef2c70064ec3f

SHA1
527bd0ccaa193ed1efef45a188f03904080bc8b5

SHA256
206d660fd5782f1d5272cac43842e433399290f6e60c474356ad50408dc1a9d2

SHA512
0a87e59fec8b60af67849484f70f6bd149ee9839e1311cca21b35b6306b8a7c9a8ca80c8357ccc3aabcb99124e4450e33d6bb3d86231c026e24dabb0a3e2c745

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.3MB

MD5
e2a9266e6d07d315ef9ef2c70064ec3f

SHA1
527bd0ccaa193ed1efef45a188f03904080bc8b5

SHA256
206d660fd5782f1d5272cac43842e433399290f6e60c474356ad50408dc1a9d2

SHA512
0a87e59fec8b60af67849484f70f6bd149ee9839e1311cca21b35b6306b8a7c9a8ca80c8357ccc3aabcb99124e4450e33d6bb3d86231c026e24dabb0a3e2c745

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.3MB

MD5
e2a9266e6d07d315ef9ef2c70064ec3f

SHA1
527bd0ccaa193ed1efef45a188f03904080bc8b5

SHA256
206d660fd5782f1d5272cac43842e433399290f6e60c474356ad50408dc1a9d2

SHA512
0a87e59fec8b60af67849484f70f6bd149ee9839e1311cca21b35b6306b8a7c9a8ca80c8357ccc3aabcb99124e4450e33d6bb3d86231c026e24dabb0a3e2c745

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll

Filesize
783KB

MD5
19a5e33fd9785adb026929fb7f442983

SHA1
721b7e254f500a63038d442138e3eb63b4f8d324

SHA256
7c00084a5b211f75755afbbb96ab851bfb02316d6a5f208d3718e10ade597226

SHA512
1f0e8d2993eb749dc834bb04aba5a6ced7f33ea085822874adde138df72f14e716484203bfcc9f95b0d52b51f392c0269fd5f1e0b6ee49bb4806c587cb419f96

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll

Filesize
783KB

MD5
19a5e33fd9785adb026929fb7f442983

SHA1
721b7e254f500a63038d442138e3eb63b4f8d324

SHA256
7c00084a5b211f75755afbbb96ab851bfb02316d6a5f208d3718e10ade597226

SHA512
1f0e8d2993eb749dc834bb04aba5a6ced7f33ea085822874adde138df72f14e716484203bfcc9f95b0d52b51f392c0269fd5f1e0b6ee49bb4806c587cb419f96

Download Submit
\??\pipe\crashpad_5028_BWKYVWTRLKNHTWNK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1020-651-0x0000000000400000-0x000000000179F000-memory.dmp

Filesize
19.6MB

Download
memory/1020-666-0x0000000000400000-0x000000000179F000-memory.dmp

Filesize
19.6MB

Download
memory/1100-686-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/1100-692-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/1100-697-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/1100-696-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/1100-695-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/1100-694-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/1100-693-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/1100-691-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/1100-687-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/1100-685-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/1100-683-0x0000000000400000-0x000000000179F000-memory.dmp

Filesize
19.6MB

Download
memory/1172-374-0x0000000000400000-0x000000000179F000-memory.dmp

Filesize
19.6MB

Download
memory/1372-450-0x0000000000400000-0x000000000179F000-memory.dmp

Filesize
19.6MB

Download
memory/1896-432-0x0000000000400000-0x000000000179F000-memory.dmp

Filesize
19.6MB

Download
memory/1972-500-0x00000232BAE60000-0x00000232BAE80000-memory.dmp

Filesize
128KB

Download
memory/1972-502-0x00000232BAE20000-0x00000232BAE40000-memory.dmp

Filesize
128KB

Download
memory/1972-505-0x00000232BB230000-0x00000232BB250000-memory.dmp

Filesize
128KB

Download
memory/1972-625-0x0000022AB6D70000-0x0000022AB869F000-memory.dmp

Filesize
25.2MB

Download
memory/1972-707-0x0000022AB6D70000-0x0000022AB869F000-memory.dmp

Filesize
25.2MB

Download
memory/2676-449-0x0000000000400000-0x000000000179F000-memory.dmp

Filesize
19.6MB

Download
memory/3124-435-0x0000000000400000-0x000000000179F000-memory.dmp

Filesize
19.6MB

Download
memory/5028-620-0x0000000000400000-0x000000000179F000-memory.dmp

Filesize
19.6MB

Download
memory/5028-317-0x0000000000400000-0x000000000179F000-memory.dmp

Filesize
19.6MB

Download