4b9e4bbd675a45f1a99d54bff55576ba3c6d79ab76ea30e143d89fc1543e8580

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Files/Apps/bts.bat
Size

227B
MD5

0cfdb01d34041f9e16ddd9f17e3f4789
SHA1

393afcbc7fb973b5c2893b8085092f0c2c45311e
SHA256

528ed4942a647ee78a31aaa788ef27b7fe747fcf9fc0e97192ad9a0aaf97c0c2
SHA512

19e96f69fe9b335941b2ae107ca5eeb366825a399428df4af86faabc9f858e09b5bdb4080cff0db89c3a49dd26b77aa25b0e857572a4c39afddc112b113adcd0

Score

8^/10

execution persistence

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

5 1328 powershell.exe
12 1328 powershell.exe
Downloads MZ/PE file

flow	pid	process
5	1328	powershell.exe
12	1328	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Spotify.exeSpotify.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 14 IoCs

Processes:

Spotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exe

pid	process
3552	Spotify.exe
3532	Spotify.exe
4320	Spotify.exe
4832	Spotify.exe
1200	Spotify.exe
2360	Spotify.exe
4912	Spotify.exe
1196	Spotify.exe
4260	Spotify.exe
4460	Spotify.exe
3856	Spotify.exe
1572	Spotify.exe
4444	Spotify.exe
2568	Spotify.exe

Loads dropped DLL 43 IoCs

Processes:

Spotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exe

pid	process
3532	Spotify.exe
3532	Spotify.exe
3532	Spotify.exe
4320	Spotify.exe
4320	Spotify.exe
4320	Spotify.exe
4832	Spotify.exe
4832	Spotify.exe
4832	Spotify.exe
1200	Spotify.exe
1200	Spotify.exe
1200	Spotify.exe
2360	Spotify.exe
2360	Spotify.exe
2360	Spotify.exe
1200	Spotify.exe
1200	Spotify.exe
1200	Spotify.exe
1200	Spotify.exe
4912	Spotify.exe
4912	Spotify.exe
4912	Spotify.exe
1196	Spotify.exe
1196	Spotify.exe
1196	Spotify.exe
4260	Spotify.exe
4260	Spotify.exe
4260	Spotify.exe
4460	Spotify.exe
4460	Spotify.exe
4460	Spotify.exe
3856	Spotify.exe
3856	Spotify.exe
3856	Spotify.exe
1572	Spotify.exe
1572	Spotify.exe
1572	Spotify.exe
4444	Spotify.exe
4444	Spotify.exe
4444	Spotify.exe
2568	Spotify.exe
2568	Spotify.exe
2568	Spotify.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Spotify.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

4368 powershell.exe
1328 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

8 raw.githubusercontent.com
12 raw.githubusercontent.com

pid	process
4368	powershell.exe
1328	powershell.exe

flow	ioc
8	raw.githubusercontent.com
12	raw.githubusercontent.com

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Spotify.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Spotify.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Spotify.exe

Drops file in Program Files directory 27 IoCs

Processes:

Spotify.exe

description	ioc	process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1605649620\LICENSE	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1605649620\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1660469722\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1660469722\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1219774084\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1660469722\ssl_error_assistant.pb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_418262786\privacy-sandbox-attestations.dat	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1605649620\keys.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1464842846\preloaded_data.pb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1464842846\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1436813293\_platform_specific\win_x64\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1219774084\cr_en-us_500000_index.bin	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1605649620\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1436813293\LICENSE	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_418262786\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1219774084\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1464842846\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1660469722\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1436813293\_platform_specific\win_x64\widevinecdm.dll	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1219774084\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1605649620\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1436813293\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_418262786\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1464842846\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1436813293\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1436813293\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3532_418262786\_metadata\verified_contents.json	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Spotify.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133765573775973593"	Spotify.exe

Modifies registry class 15 IoCs

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

Processes:

powershell.exepowershell.exeSpotify.exe

pid	process
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
4368	powershell.exe
4368	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
1328	powershell.exe
3532	Spotify.exe
3532	Spotify.exe
3532	Spotify.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeIncreaseQuotaPrivilege	1328	powershell.exe
Token: SeSecurityPrivilege	1328	powershell.exe
Token: SeTakeOwnershipPrivilege	1328	powershell.exe
Token: SeLoadDriverPrivilege	1328	powershell.exe
Token: SeSystemProfilePrivilege	1328	powershell.exe
Token: SeSystemtimePrivilege	1328	powershell.exe
Token: SeProfSingleProcessPrivilege	1328	powershell.exe
Token: SeIncBasePriorityPrivilege	1328	powershell.exe
Token: SeCreatePagefilePrivilege	1328	powershell.exe
Token: SeBackupPrivilege	1328	powershell.exe
Token: SeRestorePrivilege	1328	powershell.exe
Token: SeShutdownPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeSystemEnvironmentPrivilege	1328	powershell.exe
Token: SeRemoteShutdownPrivilege	1328	powershell.exe
Token: SeUndockPrivilege	1328	powershell.exe
Token: SeManageVolumePrivilege	1328	powershell.exe
Token: 33	1328	powershell.exe
Token: 34	1328	powershell.exe
Token: 35	1328	powershell.exe
Token: 36	1328	powershell.exe
Token: SeIncreaseQuotaPrivilege	1328	powershell.exe
Token: SeSecurityPrivilege	1328	powershell.exe
Token: SeTakeOwnershipPrivilege	1328	powershell.exe
Token: SeLoadDriverPrivilege	1328	powershell.exe
Token: SeSystemProfilePrivilege	1328	powershell.exe
Token: SeSystemtimePrivilege	1328	powershell.exe
Token: SeProfSingleProcessPrivilege	1328	powershell.exe
Token: SeIncBasePriorityPrivilege	1328	powershell.exe
Token: SeCreatePagefilePrivilege	1328	powershell.exe
Token: SeBackupPrivilege	1328	powershell.exe
Token: SeRestorePrivilege	1328	powershell.exe
Token: SeShutdownPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeSystemEnvironmentPrivilege	1328	powershell.exe
Token: SeRemoteShutdownPrivilege	1328	powershell.exe
Token: SeUndockPrivilege	1328	powershell.exe
Token: SeManageVolumePrivilege	1328	powershell.exe
Token: 33	1328	powershell.exe
Token: 34	1328	powershell.exe
Token: 35	1328	powershell.exe
Token: 36	1328	powershell.exe
Token: SeIncreaseQuotaPrivilege	1328	powershell.exe
Token: SeSecurityPrivilege	1328	powershell.exe
Token: SeTakeOwnershipPrivilege	1328	powershell.exe
Token: SeLoadDriverPrivilege	1328	powershell.exe
Token: SeSystemProfilePrivilege	1328	powershell.exe
Token: SeSystemtimePrivilege	1328	powershell.exe
Token: SeProfSingleProcessPrivilege	1328	powershell.exe
Token: SeIncBasePriorityPrivilege	1328	powershell.exe
Token: SeCreatePagefilePrivilege	1328	powershell.exe
Token: SeBackupPrivilege	1328	powershell.exe
Token: SeRestorePrivilege	1328	powershell.exe
Token: SeShutdownPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeSystemEnvironmentPrivilege	1328	powershell.exe
Token: SeRemoteShutdownPrivilege	1328	powershell.exe
Token: SeUndockPrivilege	1328	powershell.exe
Token: SeManageVolumePrivilege	1328	powershell.exe
Token: 33	1328	powershell.exe
Token: 34	1328	powershell.exe
Token: 35	1328	powershell.exe
Token: 36	1328	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Spotify.exe

pid process

3532 Spotify.exe
3532 Spotify.exe
3532 Spotify.exe
3532 Spotify.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Spotify.exe

pid process

3532 Spotify.exe
3532 Spotify.exe
3532 Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.exepowershell.exepowershell.exeSpotify.exe

description	pid	process	target process
PID 3584 wrote to memory of 1732	3584	cmd.exe	cmd.exe
PID 3584 wrote to memory of 1732	3584	cmd.exe	cmd.exe
PID 3584 wrote to memory of 692	3584	cmd.exe	cmd.exe
PID 3584 wrote to memory of 692	3584	cmd.exe	cmd.exe
PID 692 wrote to memory of 2828	692	cmd.exe	chcp.com
PID 692 wrote to memory of 2828	692	cmd.exe	chcp.com
PID 3584 wrote to memory of 2192	3584	cmd.exe	chcp.com
PID 3584 wrote to memory of 2192	3584	cmd.exe	chcp.com
PID 3584 wrote to memory of 3048	3584	cmd.exe	chcp.com
PID 3584 wrote to memory of 3048	3584	cmd.exe	chcp.com
PID 3584 wrote to memory of 1328	3584	cmd.exe	powershell.exe
PID 3584 wrote to memory of 1328	3584	cmd.exe	powershell.exe
PID 4368 wrote to memory of 4264	4368	powershell.exe	SpotifyFullSetup.exe
PID 4368 wrote to memory of 4264	4368	powershell.exe	SpotifyFullSetup.exe
PID 1328 wrote to memory of 3532	1328	powershell.exe	Spotify.exe
PID 1328 wrote to memory of 3532	1328	powershell.exe	Spotify.exe
PID 3532 wrote to memory of 4320	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 4320	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 1200	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 4832	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 4832	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe
PID 3532 wrote to memory of 2360	3532	Spotify.exe	Spotify.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Files\Apps\bts.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:2828
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2192
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "irm https://schooicodes.github.io/file_hosting/bts.ps1 | iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks system information in the registry
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.50.335 --initial-client-data=0x3b0,0x3b4,0x3b8,0x3ac,0x3bc,0x7ffe02372eb8,0x7ffe02372ec4,0x7ffe02372ed0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4320
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2100,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=2104 --mojo-platform-channel-handle=2096 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1200
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --field-trial-handle=2164,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=2408 --mojo-platform-channel-handle=2404 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4832
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --field-trial-handle=2500,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=2524 --mojo-platform-channel-handle=2520 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2360
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --string-annotations=is-enterprise-managed=no --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4844,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=4896 --mojo-platform-channel-handle=4892 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4912
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --field-trial-handle=5660,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=5640 --mojo-platform-channel-handle=5648 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1196
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --field-trial-handle=5300,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=5572 --mojo-platform-channel-handle=5648 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4260
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --field-trial-handle=3868,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6180 --mojo-platform-channel-handle=6188 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4460
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --field-trial-handle=672,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6176 --mojo-platform-channel-handle=5424 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3856
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --field-trial-handle=6136,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=3940 --mojo-platform-channel-handle=1044 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1572
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --field-trial-handle=6152,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6244 --mojo-platform-channel-handle=6176 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4444
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.50.335" --field-trial-handle=1220,i,6986435901493429442,5251470786100643788,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6340 --mojo-platform-channel-handle=6356 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoLogo -NoProfile -Command & 'C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-11-20_06-22-14\SpotifyFullSetup.exe'
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-11-20_06-22-14\SpotifyFullSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-11-20_06-22-14\SpotifyFullSetup.exe"
  2⤵
  PID:4264
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    PID:3552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1219774084\manifest.json

Filesize
108B

MD5
38c0df9de441bb37256b1ced626a6abb

SHA1
4d0741e4acf4fd2cd7c452573511c23ffb114a2d

SHA256
c0c63e7f0dfda264e515bc36809c36484ef50a31926974a6085577bd25e3b9cc

SHA512
ddcffddaf19d546d6dc78fae94a1a9ff0418bfba98cb9302be115e87cf527697218dd07be63a76d67b225f591550fe0a8761ae3aa6c6da389e7f75e66d13076d

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1436813293\manifest.json

Filesize
1001B

MD5
2ff237adbc218a4934a8b361bcd3428e

SHA1
efad279269d9372dcf9c65b8527792e2e9e6ca7d

SHA256
25a702dd5389cc7b077c6b4e06c1fad9bdea74a9c37453388986d093c277d827

SHA512
bafd91699019ab756adf13633b825d9d9bae374ca146e8c05abc70c931d491d421268a6e6549a8d284782898bc6eb99e3017fbe3a98e09cd3dfecad19f95e542

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1464842846\manifest.json

Filesize
232B

MD5
ee8bf8833efd1c1cdbe87956dbf751eb

SHA1
cbf347cb9754100adf3a4fca18b52bc34341fda8

SHA256
1a2dfbb6ca484e2c57753b70d0e6f37b424366123ecb572aecc2498a5e823039

SHA512
745b16bbd053e0f598b9e4fc1c4f38a230849980ced8468ca509e0f671798de7035bc4e03b98cab27a748944885ec78a786db725d8e41d9525b29392b2e4a460

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1605649620\manifest.json

Filesize
80B

MD5
077da41a01dde0173ebbf70d3b7210e2

SHA1
4b3c3deeb9522ca4ef4e42efcf63b2674f6a5c07

SHA256
23bed5c8ebea0c376483374bad7baf633a7e52f3e0a609371c518e06e645bda0

SHA512
2822d02e2b3c6306e6d71fa62e7f472b4c3cdf0cbe499b70ac60a0a50e547ed47c394d7de88bbef2e6015920442b9d30cbc0d6869d154e02ec251712f918deec

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3532_1660469722\manifest.json

Filesize
76B

MD5
4aaa0ed8099ecc1da778a9bc39393808

SHA1
0e4a733a5af337f101cfa6bea5ebc153380f7b05

SHA256
20b91160e2611d3159ad82857323febc906457756678ab73f305c3a1e399d18d

SHA512
dfa942c35e1e5f62dd8840c97693cdbfd6d71a1fd2f42e26cb75b98bb6a1818395ecdf552d46f07dff1e9c74f1493a39e05b14e3409963eff1ada88897152879

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3532_418262786\manifest.fingerprint

Filesize
66B

MD5
8ac6a1f62bbf02eb81e73c5830eacccf

SHA1
4ecb6ec061d949b7452b3d236475211014e46545

SHA256
949ff1075fbedd48d812d73146156ab0b5feae800e5b98ecf0d1bfaeae3a8952

SHA512
db7f1464a1d799d6245eeedfd55fa446f175409ac6768bd306a9e58afebf7f44d0969c438eb442daa5d1325f7d28b5dc029e7a9b1ed21314b3dcbe892527d2a2

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping3532_418262786\manifest.json

Filesize
98B

MD5
c24a5c797abed824fae813dd3581f635

SHA1
cd71dfcdc3bcc7fe1cedead25fa09c0da36e309a

SHA256
210067fdc7b7c1af4ff44417007223ff76ed5f33b9674d7196fd94207c45da2a

SHA512
c1d3a6fe1e0c5201c4f1f6292928277c8156e81d6586e2ea7462f6fe0f50ada6dd8e93d052ba91bf0870ee217e5ed88f1bca234d59d2630e6f84c676642ff1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
2KB

MD5
a331787c0dfdc80cb31c0952316779b1

SHA1
6778ba5e3194559e11be002a447c31dc1e971476

SHA256
4af909701e2fa2220510d2969f3e94e42aa4670729efdb1d849e2e7ebcb0b25d

SHA512
c3fc1c662f53c40f5e783d150352d7d88c8ee9f63c78b392820f1e1f8a207fff22ba16512061d0d1e0efce3dbc1980373611bf7dd73b9f96db00e7f31bc11379

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
e6a30afc079413570f3ccc4a6bfd16db

SHA1
f12cb63291c0cbee21093f07725abede412a774b

SHA256
c0ff1e9dc47b7ea46ca63b73dc312f20c9cd9e181de740a466b4ad9a9336609b

SHA512
de75e90785942c092f95842b873fe687b51fd4d978ebb2f420059fd6bea5e24b7282fd67d2b04264b5bd02935d8f10ec25f409cce721691bb6e5958e6471e84e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Code Cache\js\index-dir\the-real-index~RFe58ba33.TMP

Filesize
48B

MD5
fa7c726eec389859c9bd9a4becd414b6

SHA1
521604b205943a6b74567e85d9e2fd5e2253a7e5

SHA256
3872f9d6c0f6a0c22a919ac94ca9795dfcccf10246a7b1c74d2ca6b5a55197ba

SHA512
3bd04e0c1c3cd2793caf03805678a0cfd67ef1578f7ee1f4b298777e625f01ca61228713bd8ed78359e1fe18475aa5c648e99a7c44d29c8570023bae522998a1

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State~RFe59579c.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
e683ed9de6cc359cb76a4c68e8d02302

SHA1
f93e7f29225d44a49f31cb61d61b039e87821fc1

SHA256
eec5e797c735c6e259c70313a808284181a8d24a9223a3f319a5c495c810cbd1

SHA512
628cf345d5a05f6d5f458f9573601fa1e13ec2aa338000a5d35fe959aad3b41a2b76ddc06986a1821ad7a623613ed619d601b5057346c9ec41941242727e645f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity~RFe5956e0.TMP

Filesize
859B

MD5
1926d14f51fba6ad3b0ad105625eadae

SHA1
91957f7ac7068ec3b2e8032c13dd03a14f48d992

SHA256
ebc10d2a4080300da024faa55597908b700782e152c55aa6b4fcafada5f275d1

SHA512
cc27c0dc152dcbde2fa9ef0ea2fdb3ed45bc0d1b8240805c871d72ad6f0a95ae29e25bf5d7177acc9a519b25c346ba228b423fecccdd3389ae74439a1cec7059

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\a996e804-8890-4559-9e4d-7f5613adb386.tmp

Filesize
1KB

MD5
7a45c7219cbeac4b547d042e2adcce70

SHA1
a0c154bd2c3edf99ca025fa44735847c72fac95c

SHA256
a3b0908f66c887990061e5a8d532e8319a0853b8e5c178502521be67205b68f2

SHA512
29fb1b4e1d0f519b7a69848a1760c6a77aac124fa65982bd459d8b3b420b24bb9204bd4df21290b6aa7d329d0a029174170e9982d1af84fe79bed762c8238f7f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Preferences

Filesize
8KB

MD5
aeba3ff6447086a7a0d1cd5edb57a1b3

SHA1
dcea9edc73f366ce8164e26ea19226164e405a1f

SHA256
ffbfb376d60267b3324950f329bb10df831a8c174dd81f88cd8e3e1e175b86c7

SHA512
aff110486f1ec69f1f3511da864838deb224d578c91e209b3ca99d10bae07946a1585ed053a4bad1c05a4a8625bd926656984751be44037acabcb52bdec26126

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe588018.TMP

Filesize
7KB

MD5
cde2ad606eb9bea8cc231b9a4c3f166a

SHA1
1288b38bdc531fdb7f626026fa0fe1a3efc58d8c

SHA256
b027cd152e34ee00e7909ca4570fcd3495034ad6bfeb97996f49225b970edce5

SHA512
52a50757c32539852dfa2f3f0731898510ba586e0bd102a51ea90d525d0971afb61b8d80c92ccd02b88f4b565d70e0813df0a2ca6e866c8a972df2bb408a7a1b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
5KB

MD5
0210aee7502ff8d9740f2de571932ea2

SHA1
3261e9ec6d76328aa3269aee7cfbc604c0ab0a81

SHA256
10b3441c4e6ec4af00f168118654665f42057370ff9f15eab01e26516e4dee48

SHA512
e507ce91682ba4f77cd342f47324cf5c5f629cfe0de2c41e0202a3ade555d3e11ec7e8aa8c05f92e44552b3f2a8a83d9923e081b6d0a8c79e362c6ca81e14226

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
5KB

MD5
7649946bc44bc5beead7bf3365e2dad2

SHA1
f5bb0592b9d8ff711a4d4b48eec1bb49aa25fcbd

SHA256
5c69e210b4b9784725fd68358c4a49829358abd8eae436c1301dba10bf895861

SHA512
02b0ca2dece25b83e519613d8de56445f8bad6975299f655513ee4bce0c915be14fefc77dbd72fb7c1a4ae4e8e115c93e8c8ffb53edacb5b152e973abb14db48

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
5KB

MD5
6e5d0e923d0833a3156f6663f7203c3f

SHA1
d68258958f6f76b8b8ce409ddb7facdffd04ac65

SHA256
bf3593a58dc77806948fc2b550c9b102639a642869d2ee00c823a5389339cc6d

SHA512
75a2cf1b18628d9f289d4621003cc2c0881c2a3976b1d29c40a06f4c4591f7c129f5c554ec72546d777fd866643a9edf86ff7634952bb049c7c0703fbe00ba0b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
687B

MD5
88854a5a0b8998c01f0257323883719d

SHA1
e486f021233d734a84a17ed9b5906a13af784a53

SHA256
e03746b3f77856ff72954522eeff1274d61dae96b46a10de0480dfc44fa89096

SHA512
e48f1a64711ec229893470ba04d25ed88e6916b8148ff80188243d43317f19d562203aa7267f0de3992ecb10ee1761c3493d75c807bfd6667687c050e4a87c18

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
2KB

MD5
cb1967048381f3fd1c9e24f39a0097ce

SHA1
ea4a961d87cc5bafe3d34eab5926a6c39b334ca0

SHA256
1c72af49b32a32835eefbd43c75131dc2294f1751e34ac1146bc8b6796472cc5

SHA512
592904e629f15446a4953f198466b1b8c7141b2e5d92efb267143cfdfe53aa9d1a302acf77a909845c822ffede2502131aca24c9e2feda9c6619448ca8916344

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
5KB

MD5
1109263caec5a30beb45464e7e8116bb

SHA1
a8cf74cb79e5c807efd45bf4ea307fa1e5f62731

SHA256
a614c40f37d7f6cf34991a64f7a4a4f8058e0594ffdd21213b681825df479531

SHA512
e57cbc3c2f0790e9f9b6654b23d7bdbc8c0ecf334f4c8b02bf6c3b90632fbf6f6e5bae778c6ce842eb011604f0fa0a355d6c9e995085d7a634fb31d9e9defa2b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State~RFe5830bf.TMP

Filesize
519B

MD5
2f46e9f781e14f60abd95789df9441b2

SHA1
50aca1f220abd20f59a2ab5f62bf432706864520

SHA256
d8b3c7bdfa2d5fe4c997e1a6d24719c8db5d0d427c719412998a998f781a32e1

SHA512
e25bff3685e4a86d05c112aab81ee93aa09b7f46afdecd96402e1a9aea7a4f43cf56d398a41da0e09242ccab106bbb1d070b9377f5d78f50decdc24e36f0d49f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\MEIPreload\1.0.7.1652906823\preloaded_data.pb

Filesize
8KB

MD5
d5e4c2634eff8a9b3faf432bf406d6d1

SHA1
a691f5c9877079193c1f7dfb16dbc30bb0372ec9

SHA256
c6070a157b4e28d16fbccbd233e93846ddb070c85e1a1bc64469b7a5f1424fad

SHA512
b264e28ac8f111df01c553445aadc7bcdb3f32a38a1a19d3f9d458270dfeaf80efa7144407bd999892022af9dde9dbf8a0e19e7212720e1c6511ea9125afb166

Download Submit
C:\Users\Admin\AppData\Local\Spotify\PrivacySandboxAttestationsPreloaded\2024.11.18.0\privacy-sandbox-attestations.dat

Filesize
7KB

MD5
9965220286a9142ab15ef18312cc029a

SHA1
99cfe40e28d12d686b1c09debb4d0c7f99d3feca

SHA256
0d56b99d65ce82163fc2063cb1bd913da5f772dfbe00cf5fa3cef781ac010928

SHA512
a903a851c476b486e5684abaf980745a1f174b627e3cb19aab1e4b9f4d5ab925518857df970b40720a9281f856019e8f8254e4ce6f37201ee2725dbbc57b009a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\SSLErrorAssistant\7\ssl_error_assistant.pb

Filesize
2KB

MD5
e2f792c9e2dd86f39e8286b2ead2fc70

SHA1
8a32867614d2a23e473ed642056ded8e566687f9

SHA256
ac354a4723aaa4f06bec385ddde4a4d0983ad51456f52b31a8068ec97d5b5ea7

SHA512
6a7af0ca1efa65a89a9ca3b8df0d2e24f21d91673c60cdfeeb02d33647442b01d535497249542f40e66e0d2dd3e9f8ed1f4a201fd97138d07a2b71366737e580

Download Submit
C:\Users\Admin\AppData\Local\Spotify\TrustTokenKeyCommitments\2024.10.11.1\keys.json

Filesize
6KB

MD5
052b398cc49648660aaff778d897c6de

SHA1
d4fdd81f2ee4c8a4572affbfd1830a0c574a8715

SHA256
47ec07ddf9bbd0082b3a2dfea39491090e73a09106945982e395a9f3cb6d88ae

SHA512
ed53d0804a2ef1bc779af76aa39f5eb8ce2edc7f301f365eeaa0cf5a9ab49f2a21a24f52dd0eb07c480078ce2dd03c7fbb088082aea9b7cdd88a6482ae072037

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
92a37f9a19a601bdee917b1353804080

SHA1
dcdb069bf67e418bed9750e1024d539829928cf3

SHA256
3fc150dc021bea81ba33bc0006196c80097e25d3935b35a2202de3b6ee9a6d7f

SHA512
e774241838b42ae80019330b7907eaebe9ece733c4404a4294e611ead707a339013c8ae1d50127f45e3155b6092dfc0cd0f8f06eff772b1bc81a66106657ad4a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlockTheSpot-2024-11-20_06-22-14\config.ini

Filesize
101B

MD5
72d74873a9d7f5905ffe33abbb83ce5c

SHA1
bde774f7a4e2e0320a80e8b6bcfd3f1d496fd966

SHA256
45c2bc29abefa7af80b4ae0bb3e67feb1c2ab2e54922915839099cc6fcf78b43

SHA512
ce7fc7b3c39300fb8e7a438ecc21849e4f62055baace0e0c3f44db8fde905f057dd48c7cc41b28234e38154cb9a54d9d4c81c9fd5afb3a0e9964b5685867986b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rha0fa2p.iw3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
3.5MB

MD5
5fb1d423ea9a1b994970058199b8339f

SHA1
76f49bcce269b08c5825925253fbee1456af8fee

SHA256
0db6f75c14991d0008787670c3cba667e31c67dc511fd6e10e37b577b283bf41

SHA512
abe9ad12a0c384170cc4147fbe7b2f19917e0bdc363889596e62c9a5fc305e3093f7c9ac274b62258451dcba09619dd35554d3e65fc91cf86f1b1ad725ecb50a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
34.6MB

MD5
86e8dc9e5bbabf31677dd9c5cbef836a

SHA1
1bebd03cbc2cc89d133127d2f90925cf9edeba20

SHA256
adfd77c6d1540a9e8907bdfaa4c94d5deb4b6ea1402e299ddf331aa3c933bd32

SHA512
45d232c275acdab03134206b8a0c613addbe1be8d2fd00c7eb941449639fb7140c64713b021b9a9ea560042ef0e28a696ff6405144863583f727aaf8566fd9f2

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
679KB

MD5
315618a9e00e46ff870d9c0de2509121

SHA1
a1401e40bc28ddbddbd6fcacb29c4aba43741e5d

SHA256
9e3bfa5ab9ed42990ad4bebc2edcfa01ce9ff694df9f09cf2fa0b2b235e94710

SHA512
8ab44c9b7e12702daf703d97346738148c950d779329983a1f2806b0fb350d77726e73a7f96f3eca1197e411116401ab6550e1ca92e89dbb5fb7a163569a1d5e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
6c5b88cb407f1e109fd5e8efc759022c

SHA1
1a51194713a44f7f6cde9eb4654b105a18106aec

SHA256
9158e9ffa46b73bd6d2f5ad7cb8c7e210b4cfd66dcd0ffcac051939c60a7c93e

SHA512
48666fa041c13b21966d4d8fbbef070c8ed09b0c81e37b127f0526b01d8e146cab452007fcc84399f34e5309ee48681083faf3fe64d2e92a088f2dc7470404a9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.3MB

MD5
fe747205c07d2b32aa56886c027a20f1

SHA1
4b4847048e2fe1d8b82fa7d1370ba21c68ed1d1c

SHA256
31e2c545854a4bbe4df3d25ca52fa060547768b1e209ffb7656c449567c48e73

SHA512
831a9024d3cf6cf9c5fc9e5254509d9d4662873b8b6f73066a6e520c1549970cb5f6846bfaf78db31d701e48e2e1409b50bd3e8cbd8790be166f268ff29a031a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
577B

MD5
ee12147d0727005e9aa586329743d466

SHA1
ec54382f883e84615a4f2404432aacc05975bf4c

SHA256
37e3d255f3bf336348301955be50775b06e932c39adaaef3627468c2305a5080

SHA512
6a520534cc17bf2746a6479b1947903d06c780d595b3bbfc38b6bb2cebb553f26dedca41ce5945c63fa54eaba125b15636fbf4dbfc05305ffa9522efebd91ad8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
4.7MB

MD5
72286e17c756a6598ecc5d38cded39ad

SHA1
df10a3ec54485942e0ebefa319d383640f16e13d

SHA256
9d80e39b28b3215abdc040940a4687acb45271671be94e924ae81769ba67f2f6

SHA512
67af8c894ad76d879ef93331371425e65c9ad55d5dfbf69fc5973af426820ec057535ad2d43f97da6b6a1cfb2665a5e320f98bffb8cabf516e5b38de759b8675

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\dpapi.dll

Filesize
844KB

MD5
88272615e85047f6e8b1f9bea2bde31f

SHA1
2e59165f52360fe412a0f75ade566053bd5657e7

SHA256
e3af73a03e35bac46045ec528496dc6009fedd6159e853ea761cda61837b044a

SHA512
313f6bf5269f51139616f68b410ba9fab11fb6254fb910678b5bfd342cf9c34cebf542f6e131b10c236c0d2ff3e18b17e9b24980b402e6792b75b9a5fad96304

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
493KB

MD5
621b2a7bf1db1890173a21c617e6bbc8

SHA1
36e1b63ea2f38c8aced826908b378a0e993cc068

SHA256
853cb46ec098e3bb53abc8cf21cd88d18d4c9661447affa238880ce0d57a4dd1

SHA512
c72e58c5cdcb35f79987f7103dc7c2a17715a25dc88bd118897fa7cb316cec2b7b2686a0d1221d2ec5469961d0906c720c1e799ec5bb178c4c96883690510b4d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
7.9MB

MD5
e13e09dce6704eb5313ef73add37164d

SHA1
e035f0e863a5f1c463340461c0654e51961e064b

SHA256
00095e7528740753d5982d11d4d11205f8ff5b411690e596efc8519dda924d9c

SHA512
ec01eed0c2829613d9526e1eeb2f2790db76e120a4644553b927b19026dbb4cf2ec44b546323e8f2e4ea82f735103113860a38f94e1f29508af14c5849173a21

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
489KB

MD5
fda63a59f6f00864ff7b4992b994df92

SHA1
3d65883b5d35dbf7b80ff3f5d1812d281156d645

SHA256
e9b342f0a903b1dfe41298dbfe103720466b104ee90c696d5af7f489b6deeb88

SHA512
5a6b74e1424ade1f1bda8a2f91c47dc17c2a5a671c6558e347790bff55b01cfaa367faec4bdba13b2ecd8e678b04307238a23d3225a4393d4d7591aaf8fcbdbe

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
87c1890da8303ed7040602d7b20dca83

SHA1
b8c6cfe3cf2486388715f1f854290186174520c1

SHA256
91360c336405111a7f0ef18cbf0f4ad95d59600cb8a1b57d2a205612b5fd13b8

SHA512
472006d4a2f77711320d71a6267aed3fbbf64336da9fc1283878fe672470c42da798ba20b0a34c0575b8346400fd4b943fd5decedfeb395632dd219151e616f3

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.4MB

MD5
49a1019b3eaf66dc7859bb15cb66b56e

SHA1
2bb25cc83ec2fc9049c176e377aa081e17c4b835

SHA256
d16040ce315f751c424ff81f8e31aa4aa8706b939c0e31b4040048813fe3996a

SHA512
db24ccaf3546e2eb786213f635f7751f0432dfee9078817d05db5c68e63d93c42e03f7c227f11d62f13b6bf0b4a145b0120a0f1e912cf27de2df3a2dc27bba73

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
674KB

MD5
e4891fff1d2ec3b05b842f7f8748138c

SHA1
2f80a8e0716b8849d71d30bb4d8225acad2aaad9

SHA256
4850882ed1bab3718d815ea31e793808c1505f92c05605cb21ba32e234b0edae

SHA512
f6d11610545a61e33798ee2a4c9ff5aad9c155c61d31879344c57a8a0b2c6767cc34f9c9ad4751966699d0eac131acb451c2b2e990d560ca07e5f60b4d31ea94

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
5.1MB

MD5
b9eca1596f8ef5542d037de5a18aecbe

SHA1
6842fe243cfd63f9c17f782af62e0f59ee9d8954

SHA256
fbd02a30a94d582241f0c1c23912fa024ea25191075738a9e09ff1db28f79d4a

SHA512
a99456b1bf5b35839effb30e5c27c6dbe996488d0d6b100ba70c6abaeae8092c8d8459f324846fadcb434d5acc41d874451e9dee0758c7106bda8bce930c3d97

Download Submit
\??\pipe\crashpad_3532_UNCMEHEQVOXUKAGA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1328-233-0x0000018AF8590000-0x0000018AF85A2000-memory.dmp

Filesize
72KB

Download
memory/1328-20-0x00007FFE0AA33000-0x00007FFE0AA35000-memory.dmp

Filesize
8KB

Download
memory/1328-10-0x0000018AF5B40000-0x0000018AF5B62000-memory.dmp

Filesize
136KB

Download
memory/1328-268-0x00007FFE0AA30000-0x00007FFE0B4F1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-234-0x0000018AF82D0000-0x0000018AF82DA000-memory.dmp

Filesize
40KB

Download
memory/1328-232-0x00007FFE0AA30000-0x00007FFE0B4F1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-11-0x00007FFE0AA30000-0x00007FFE0B4F1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-12-0x00007FFE0AA30000-0x00007FFE0B4F1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-230-0x00007FFE0AA30000-0x00007FFE0B4F1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-13-0x0000018AF83C0000-0x0000018AF8582000-memory.dmp

Filesize
1.8MB

Download
memory/1328-35-0x00007FFE0AA30000-0x00007FFE0B4F1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-23-0x00007FFE0AA30000-0x00007FFE0B4F1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-14-0x0000018AF8190000-0x0000018AF81A6000-memory.dmp

Filesize
88KB

Download
memory/1328-22-0x00007FFE0AA30000-0x00007FFE0B4F1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-21-0x00007FFE0AA30000-0x00007FFE0B4F1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-15-0x0000018AF81B0000-0x0000018AF81BA000-memory.dmp

Filesize
40KB

Download
memory/1328-19-0x0000018AF82A0000-0x0000018AF82B4000-memory.dmp

Filesize
80KB

Download
memory/1328-0-0x00007FFE0AA33000-0x00007FFE0AA35000-memory.dmp

Filesize
8KB

Download
memory/1328-17-0x0000018AF8210000-0x0000018AF8236000-memory.dmp

Filesize
152KB

Download
memory/1328-18-0x00007FFE0AA30000-0x00007FFE0B4F1000-memory.dmp

Filesize
10.8MB

Download
memory/1328-16-0x0000018AF8240000-0x0000018AF8266000-memory.dmp

Filesize
152KB

Download
memory/2360-317-0x00007FFE27970000-0x00007FFE27971000-memory.dmp

Filesize
4KB

Download
memory/2360-316-0x00007FFE27CF0000-0x00007FFE27CF1000-memory.dmp

Filesize
4KB

Download
memory/3532-263-0x00007FFDAB5A0000-0x00007FFDAB5B0000-memory.dmp

Filesize
64KB

Download
memory/3532-415-0x00007FFDAB5A0000-0x00007FFDAB5B0000-memory.dmp

Filesize
64KB

Download
memory/3532-262-0x00007FFDAB5A0000-0x00007FFDAB5B0000-memory.dmp

Filesize
64KB

Download
memory/3532-509-0x00007FF610AF0000-0x00007FF612DCD000-memory.dmp

Filesize
34.9MB

Download
memory/3532-414-0x00007FFDAB5A0000-0x00007FFDAB5B0000-memory.dmp

Filesize
64KB

Download
memory/3532-269-0x00007FF610AF0000-0x00007FF612DCD000-memory.dmp

Filesize
34.9MB

Download
memory/3552-231-0x00007FF610AF0000-0x00007FF612DCD000-memory.dmp

Filesize
34.9MB

Download