vidar | hxxps://www[.]mediafire[.]com/file/g2x9mbajf2i8k9a/Spotify_Premium_8[.]7[.]14[.]1332_%255BFull_Version%255D[.]rar/file

Analysis

max time kernel
81s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/g2x9mbajf2i8k9a/Spotify_Premium_8.7.14.1332_%255BFull_Version%255D.rar/file

Score

10^/10

vidar 408 spyware stealer

Malware Config

Extracted

Family

vidar

Version

2.5

Botnet

408

Attributes

profile_id
408

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Executes dropped EXE 1 IoCs

Processes:

Setup.exe

pid process

2032 Setup.exe
Loads dropped DLL 2 IoCs

Processes:

AppLaunch.exe

pid process

2884 AppLaunch.exe
2884 AppLaunch.exe
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 2032 set thread context of 2884 2032 Setup.exe AppLaunch.exe

pid	process
2032	Setup.exe

pid	process
2884	AppLaunch.exe
2884	AppLaunch.exe

description	pid	process	target process
PID 2032 set thread context of 2884	2032	Setup.exe	AppLaunch.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AppLaunch.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AppLaunch.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 467899b2bcaed801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3578983846"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "51"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "156"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "156"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3612607727"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31015234"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "383233274"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "51"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "111"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3578983846"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "769"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "769"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31015234"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{004331B2-AD36-11ED-AECB-F22D08015D11} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "814"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{11B6271C-20C5-4231-B581-986FF1BFEBB2}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\mediafire.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "814"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "111"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "111"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "814"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31015234"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "51"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "769"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Modifies registry class 2 IoCs

Processes:

iexplore.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2884 AppLaunch.exe
2884 AppLaunch.exe

pid	process
2884	AppLaunch.exe
2884	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zG.exe

description	pid	process
Token: SeRestorePrivilege	3236	7zG.exe
Token: 35	3236	7zG.exe
Token: SeSecurityPrivilege	3236	7zG.exe
Token: SeSecurityPrivilege	3236	7zG.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

iexplore.exe7zG.exe

pid process

764 iexplore.exe
764 iexplore.exe
3236 7zG.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

iexplore.exeIEXPLORE.EXEOpenWith.exe

pid	process
764	iexplore.exe
764	iexplore.exe
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
2944	OpenWith.exe
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

iexplore.exeSetup.exe

description	pid	process	target process
PID 764 wrote to memory of 2076	764	iexplore.exe	IEXPLORE.EXE
PID 764 wrote to memory of 2076	764	iexplore.exe	IEXPLORE.EXE
PID 764 wrote to memory of 2076	764	iexplore.exe	IEXPLORE.EXE
PID 2032 wrote to memory of 2884	2032	Setup.exe	AppLaunch.exe
PID 2032 wrote to memory of 2884	2032	Setup.exe	AppLaunch.exe
PID 2032 wrote to memory of 2884	2032	Setup.exe	AppLaunch.exe
PID 2032 wrote to memory of 2884	2032	Setup.exe	AppLaunch.exe
PID 2032 wrote to memory of 2884	2032	Setup.exe	AppLaunch.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.mediafire.com/file/g2x9mbajf2i8k9a/Spotify_Premium_8.7.14.1332_%255BFull_Version%255D.rar/file
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:764 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3648

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\" -spe -an -ai#7zMap2133:146:7zEvent27419
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3236

C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\Setup.exe
"C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\Setup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2884

C:\ProgramData\20205465619298939219.exe
"C:\ProgramData\20205465619298939219.exe"
3⤵
PID:5012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\20205465619298939219.exe
4⤵
PID:2376

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 0
5⤵
PID:4004

C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\Setup.exe
"C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\Setup.exe"
1⤵
PID:4080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1212

C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\Setup.exe
"C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\Setup.exe"
1⤵
PID:5004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\20205465619298939219.exe
Filesize
7.4MB

MD5
c20965f0f720fe1249562be190dd17b2

SHA1
21ebe0421472c864756ff113154e34d27e536f12

SHA256
fa0eb0c07f81650f16550fae12b5d286ef2c4cadb1ab19ce13bdb83762d1a4a3

SHA512
c48da05164703bcab01eb40409222b2587dd8a5324d6467a836f28395cb155d2861c256306ea951cd1911696a53558100150c74add89f66380d90f1925d8bc9b

Download Submit
C:\ProgramData\20205465619298939219.exe
Filesize
7.4MB

MD5
c20965f0f720fe1249562be190dd17b2

SHA1
21ebe0421472c864756ff113154e34d27e536f12

SHA256
fa0eb0c07f81650f16550fae12b5d286ef2c4cadb1ab19ce13bdb83762d1a4a3

SHA512
c48da05164703bcab01eb40409222b2587dd8a5324d6467a836f28395cb155d2861c256306ea951cd1911696a53558100150c74add89f66380d90f1925d8bc9b

Download Submit
C:\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
e28944269d7eeb0d11663d77f668a2c6

SHA1
52403fff50ada7e2de079507790dcbf1703b1097

SHA256
69731265c0d4cac20fa9867a41a12b2f8c30160111b4e2fca9e728bac4164f81

SHA512
0f1bac906752d34ee6b1e56acac6ec2bc5227cbdff7c95afe5b724b8155c303601f7a4ef3f05fd89ce84fa9a50457ce74ba5d9ee2acfb1faeb1636807ec61a24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
3e41dd9366864e66b96c7435d56506ff

SHA1
7514d785e9fad54ffd07bde3f86d90bc4ac52bf8

SHA256
5902822e5633fd62796953f564224537bb472a22c1b4d0810f705f8e1e81603f

SHA512
ba64698f66e406a64667af24aca8f6187b9c8a477551970d8ba0a73c089b9577bf7c2c1bb95c764f84dc98fdb76d126bbdb1ae96b0657291507af46a2a922d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
7f6f0f9ee76c1891a8e3b3263dd74bf9

SHA1
4b1c60975a0a008455347d8a90acf27238716842

SHA256
466409be493909d274e78082784ff99f0ccbb1d3c3c0d292e81fc30f05d2245d

SHA512
9e7c0b484772b6a2963d7563fc30914735a2dbd853a456c5403720dbadf07c08e58837c181532f5961e85056265e685c5182d4d0be795a347cf738b7a80633bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
a7897185024e9c1d40d78ea6e0dbe119

SHA1
85d2d7a4584034fece6acc318302bcaa64d41441

SHA256
a5cf5e486d980546d5501199c65e429ea9aa24f1f855e480f1be0db18e61c378

SHA512
72e89e888e67f0253f2819616072beda61fed9ba81b3a8f497ac963a35a9053855c5dc87061eb86da6b45bc332825f9c0e3b1ad9b58fcce0e0c5a255e8cdc4f8

Download Submit
C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version].rar.fgpu0w8.partial
Filesize
7.8MB

MD5
68ec8fe70d0a5aa0fe24ad80f6b7b1a9

SHA1
b7450a3dda89e9345bb03419d5ce8186d1434ecc

SHA256
12a97140043e32e3a4f15bb9a17e16692d06c33cd56bb6d497ac6be2c5c02093

SHA512
5abf719dee7ad931553178fecfaa1d2a18c30c49345b6875780ef7ba4b5a0c79be98ceaa666ae523642733157b158f6f5a57fe3e550e8fdc741dcaff4f45a4ab

Download Submit
C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\Setup.exe
Filesize
109.7MB

MD5
7467034e59e6215aefe54323a56241f0

SHA1
9c2b463bde71f20b0898a3b09ad0c92eba1c4556

SHA256
493f3822070d32e27da95207eee57b5416fcbad4abd2322fa6fe586760657981

SHA512
be7624f783f2e7a8f5a8d970fe17914314407c59d0380f7b1ad2977c26d705fb1070a56b17237a5d7a9c549ea2a385f9e42b360433d39e67b30473ca6a45e578

Download Submit
C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\Setup.exe
Filesize
134.9MB

MD5
a44654c2fec6b5e58b0a34ca8430a4d2

SHA1
f3fbd7652797814132ec8d94422983dd4a5d399e

SHA256
167c0d51224d32979c80a454a6cc84b071c47cd2663dd4552ebcbc9798eb2c55

SHA512
d2ea915cdb8ff41eaeed1898fa39eb89254c7f38ca25bafefe82a78f3a15987290c512fcdcbc3b19ec9e8d6def10c31a86cd36ab5ff29a819edc4c85e19c977f

Download Submit
C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\Setup.exe
Filesize
115.9MB

MD5
05378a3b591c78d1b6b03bc094995d17

SHA1
f642fcc24cd283682fbc705ec89ec706022cb3e6

SHA256
9768875b3aab3b2b6b3882a9277497028411a5939ee57df2bc80afce5dd4bdad

SHA512
43cddfd030d4a05dc252026a6920fdc9f7d77ee34783a525c4afe63031c7376c6cab4c1bfb6594198cc7f28321a0668f494abfb1a8d7d3616bc481e6c5b99225

Download Submit
C:\Users\Admin\Downloads\Spotify Premium 8.7.14.1332 [Full Version]\Setup.exe
Filesize
56.8MB

MD5
c8cc9b0659de43a19d76c9943d883bab

SHA1
e91e569ef8bae2152a92fd1108e46a5a24e8be46

SHA256
a4dfeb67bae485d47eb185c34942c43b320d8b7fa4d74fa5d749270dc7be513b

SHA512
1ed05ee7b1e4d0594e6bf90d4e2e140ceca364d21edc2fa2af1c154b2f34380857b051fea800080d0d84c181bf21cebe6fefc1818f2e7620c02a9c217f54aa10

Download Submit
memory/1212-166-0x0000000000000000-mapping.dmp

Download
memory/1212-173-0x0000000000520000-0x0000000000592000-memory.dmp

Filesize
456KB

Download
memory/1212-167-0x0000000000520000-0x0000000000592000-memory.dmp

Filesize
456KB

Download
memory/1724-182-0x0000000000000000-mapping.dmp

Download
memory/1724-183-0x0000000000800000-0x0000000000872000-memory.dmp

Filesize
456KB

Download
memory/1724-189-0x0000000000800000-0x0000000000872000-memory.dmp

Filesize
456KB

Download
memory/2376-179-0x0000000000000000-mapping.dmp

Download
memory/2884-145-0x0000000050BE0000-0x0000000050CD3000-memory.dmp

Filesize
972KB

Download
memory/2884-144-0x0000000000750000-0x00000000007C2000-memory.dmp

Filesize
456KB

Download
memory/2884-137-0x0000000000000000-mapping.dmp

Download
memory/2884-138-0x0000000000750000-0x00000000007C2000-memory.dmp

Filesize
456KB

Download
memory/4004-180-0x0000000000000000-mapping.dmp

Download
memory/5012-176-0x0000000000000000-mapping.dmp

Download