lumma | bb943a4b69a11e38ae79651edb071f57da2c9989d6b840eae5efcd4e722d774d

Analysis

max time kernel
300s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2023 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spotify/Setup/SpotifySetup.exe
Size

878KB
MD5

58d0152cf6b78cf28db2096c9c06a647
SHA1

a566fe8b45c4827ac891608d49e7d06fa65349fb
SHA256

4fe8735bd23743d7c7bab8cbecb3fb6dbfd49c768e17f67dbd2ef7d3aee9eb87
SHA512

677a19617cbaa0a3c0bb9e8264ec4081ae06554668a752b4e42e083623c2869f50d897160b914ae910c255812baaca665c083998ad03d805ebf7945cd60f764a
SSDEEP

24576:wbogxqPe59uvk+AIzGiodlpk9FXDBaRw0LTWZda0DeAYOWKCrrFaDPJI:aogB9sAIzGiodl8XDBsTWT1CAYOWKCrf

Score

10^/10

lumma discovery persistence stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Spotify.exeSpotify.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 9 IoCs

Processes:

SpWebInst0.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exe

pid process

64 SpWebInst0.exe
4376 Spotify.exe
2396 Spotify.exe
3276 Spotify.exe
4288 Spotify.exe
5024 Spotify.exe
2288 Spotify.exe
1332 Spotify.exe
1532 Spotify.exe

pid	process
64	SpWebInst0.exe
4376	Spotify.exe
2396	Spotify.exe
3276	Spotify.exe
4288	Spotify.exe
5024	Spotify.exe
2288	Spotify.exe
1332	Spotify.exe
1532	Spotify.exe

Loads dropped DLL 22 IoCs

Processes:

Spotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exe

pid	process
4376	Spotify.exe
4376	Spotify.exe
2396	Spotify.exe
2396	Spotify.exe
3276	Spotify.exe
3276	Spotify.exe
5024	Spotify.exe
5024	Spotify.exe
3276	Spotify.exe
3276	Spotify.exe
3276	Spotify.exe
3276	Spotify.exe
3276	Spotify.exe
4288	Spotify.exe
4288	Spotify.exe
2288	Spotify.exe
2288	Spotify.exe
1332	Spotify.exe
1332	Spotify.exe
1532	Spotify.exe
1532	Spotify.exe
1532	Spotify.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

Processes:

Spotify.exe

description	ioc	process
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping4376_984683865\_platform_specific\win_x86\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping4376_984683865\_platform_specific\win_x86\widevinecdm.dll	Spotify.exe
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping4376_984683865\LICENSE	Spotify.exe
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping4376_984683865\manifest.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping4376_984683865\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping4376_984683865\manifest.fingerprint	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe

Modifies registry class 15 IoCs

Processes:

Spotify.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Spotify.exe

pid process

1532 Spotify.exe
1532 Spotify.exe

pid	process
1532	Spotify.exe
1532	Spotify.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Spotify.exe

description	pid	process
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe
Token: SeShutdownPrivilege	4376	Spotify.exe
Token: SeCreatePagefilePrivilege	4376	Spotify.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Spotify.exe

pid process

4376 Spotify.exe
4376 Spotify.exe
4376 Spotify.exe
4376 Spotify.exe
4376 Spotify.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Spotify.exe

pid process

4376 Spotify.exe
4376 Spotify.exe
4376 Spotify.exe
4376 Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

SpotifySetup.exeSpWebInst0.exeSpotify.exe

description	pid	process	target process
PID 4660 wrote to memory of 64	4660	SpotifySetup.exe	SpWebInst0.exe
PID 4660 wrote to memory of 64	4660	SpotifySetup.exe	SpWebInst0.exe
PID 4660 wrote to memory of 64	4660	SpotifySetup.exe	SpWebInst0.exe
PID 64 wrote to memory of 4376	64	SpWebInst0.exe	Spotify.exe
PID 64 wrote to memory of 4376	64	SpWebInst0.exe	Spotify.exe
PID 64 wrote to memory of 4376	64	SpWebInst0.exe	Spotify.exe
PID 4376 wrote to memory of 2396	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 2396	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 2396	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 3276	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe
PID 4376 wrote to memory of 4288	4376	Spotify.exe	Spotify.exe

C:\Users\Admin\AppData\Local\Temp\Spotify\Setup\SpotifySetup.exe
"C:\Users\Admin\AppData\Local\Temp\Spotify\Setup\SpotifySetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4660

C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
SpWebInst0.exe /webinstall
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Spotify.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.7.1277 --initial-client-data=0x460,0x464,0x468,0x43c,0x46c,0x68a83a38,0x68a83a48,0x68a83a54
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1740 --field-trial-handle=1912,i,2212510096512679373,16267967690441181620,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3276

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3108 --field-trial-handle=1912,i,2212510096512679373,16267967690441181620,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4288

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3124 --field-trial-handle=1912,i,2212510096512679373,16267967690441181620,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5024

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --first-renderer-process --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3904 --field-trial-handle=1912,i,2212510096512679373,16267967690441181620,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2288

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1080 --field-trial-handle=1912,i,2212510096512679373,16267967690441181620,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=4404 --field-trial-handle=1912,i,2212510096512679373,16267967690441181620,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping4376_984683865\LICENSE
Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files (x86)\chrome_ComponentUnpacker_BeginUnzipping4376_984683865\manifest.json
Filesize
984B

MD5
59741ca0b4ed8f06f8984e5c91747a4a

SHA1
334c396dd6e710de0e5b82b93cfaba764abc0331

SHA256
8dabab92309c13bbbf130183e757967bb1d80b47d06d678d12bd7009bc4e0dd7

SHA512
9ff5db978545120a033f5899444cfce08fbb3bb68afd3ca4be394adf781f42c8689c3a2a3d929c0d391a7902315e2073509eb5f8344b96e186b1a63f35d565c8

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
c4a4e10fb00fb5c442ca9963a4739dc8

SHA1
5a675ba63dcbeab5b86587b03972788790641d2f

SHA256
20070aa056bd0dfcc16cb02b78ef4957f245c8ef1c45c6bce4ce1dcaf01cd7c3

SHA512
f7adcbdff6f76bcfd5f6a2e83e03424421357f75cd4449262a5ad4c2ed660c23b1a47e3e82126b744c10bbb31b8b9dc1b0ff80367a5b6d9d9a5f724130e60fd6

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
ba37d591458df1c9d93348baca97627e

SHA1
61bbdeee1d4ad300c934822714ecb877b79b2f04

SHA256
ec5477edc6bcbc2ffb2cbb31e2ae25d1653a1aca7036a5caea5bf4c3566b70b9

SHA512
db833d945e273886582a7af1a9db2b0389245977a6e700909b6e1635070f37728d21a7cad2ae3086b0b806411157753fabbb15e35c934b5161daf5487a6cad56

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
Filesize
1KB

MD5
c4435484286b2435eb745462eae4c9c3

SHA1
b3705aeffa1fae558965a9ba2c3ac1dc22b9ce8a

SHA256
fd59c1cdb7a835c3da2647d7d047b1007c4e3a573228da8101f01f9e06f0275a

SHA512
4e32371915c980fac07986aeae0936fbaf359680ffd41db8c78432dc04c02de0db989335a9986f19d2a9e3878ea1bc2cbb009d09928f26ccf6f6aace8ec8c131

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe589342.TMP
Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity
Filesize
692B

MD5
0847c295c90d62fd684df46714d9400a

SHA1
f7237c14ca0b92efef1c84715fc884b9a04381ec

SHA256
6a872814609501191298b0e76e95bd0662578e731789a7027d388d0d6a40f49c

SHA512
d6fb1cd261ac01087d2761aa15ad58db8452a4258acffc63ba9ea4e4eac4e978d50fdbaca08968a15886cb1ee89fd1753dee9867da4df57011578f1fe3194bc0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity~RFe57df92.TMP
Filesize
692B

MD5
1a20a8a8aef1d2743016e2d42368b47a

SHA1
1955ca3190faee489332118cdc17a8cd4f4722a6

SHA256
eaa8c3c06d709f1ed191b4417f5a28b8e5232dac06e89a9c4cf68b3212309b12

SHA512
b42b7413a450dc692ae9e67873322dbd447882e0b925ff2000580cfd9ecb6ebca373cd97c849f6e8dd8bc2bb3a1dc873abb6be0550993e5ee8487242a1858048

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Session Storage\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json
Filesize
687B

MD5
24aaa29c26cae2c5f83107ab9eb78525

SHA1
6e989344aa9ce30aa58da3c6eeba04cb33c49421

SHA256
66772c12b279f7e380e8de38a0e3ccaa0714c1be9f0c1366a17366ed58edac79

SHA512
d30239ac511c3d591993908b44aabd10783417b6f1a315a320520980414c8f414b7ccb0b1213857455f334bba62bc9b4e98ae0260fd7884765ba86fd2fa180ee

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json
Filesize
780B

MD5
d44fc165dcbed4b778b2b2a79d502edb

SHA1
94b32a8cce4a271903e05cdb4e56540ea7b6f1de

SHA256
e04775a8c9c37f22e09482ca878062287e196f7afc5b5df763f6be539ebe25bf

SHA512
10df238a60bf882a06fe488fe0551650eee910e22e6acdbeccf6a3fdba4137bab12f8ba5abfec8e2167067978f4023f40128d0585c5ca567c5edc45aa88b1f42

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe57a306.TMP
Filesize
484B

MD5
b3a7e1bc87fbcbdf5fef32052d0ab9c0

SHA1
f45eb7b38f1c0ba8808a37c3c863537eb7b1d113

SHA256
bbf497864006d8bf1c877fd6944cabffa04c2123a48db8d3f38cc957bebd0175

SHA512
5d8771505d6922e5ef1e56503d38bf4c9793d1ab96891d4a328e04d61633cf5e399ee46ebca009f271ab937024ced24d3a15fb032680566acd0c8158c7e28c81

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Filesize
56B

MD5
2d92811c4b3b58c8ebbf76c019973d61

SHA1
fc4b774941927824e6298fd25f325aff94ed1d5c

SHA256
55339ca4483499be6d51fd58618e9f7715ddcb8072c885898d6d2781f8729cc8

SHA512
5f3f745e84e58a4a23bab76efde7aa18ceee6d321d88685221f14c3bb5b7cd15e52604e5ba1fd9fc01446c66765fb97d9e305891d984e78eb7d9f19c89be337a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
Filesize
1.5MB

MD5
649488d28c18f3626f1f3dc9d51f64e8

SHA1
62972f8387d9f9ae9a3cf1ad92807915345d4828

SHA256
bd1c6f44ea8032a2fb5aae336d6b636e84aa46ed2103259f490eb15287b4a3a1

SHA512
af7f568956388410d8567254d508c8bf50e5a2044a590d85bfc03dffa8e98199bb604c66febd7f8d6a7903ee5e4429ef6cfffe8a297438c82d50f2b62cf514c0

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll
Filesize
3.9MB

MD5
497dca87043d7c5d5bf8a81c61435642

SHA1
ec0b37632af422e18f507ca1188433efe629035c

SHA256
0fed010750b6eec9ed7f2d07551bd53a355d07dd10b5a6d90cd4b00cc4229329

SHA512
71f61c26dd9a54afd48aac109ef9e6bb986ffbee5d7dd8a5c83ca5eef60dffb033ef63ba740914d8a38ca1642e3b19976d7f4103d68206adfbc28d1ad2f1dd83

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
Filesize
83.5MB

MD5
5e307b5182474dd37d18cd8ada1a0285

SHA1
4d70faf2e6e3b0b5a91ecf0470a42bb9afff44cf

SHA256
5f38b643d1adddd70ae034cb4dd6f567b267c04d7a77e51c6869718630cfee92

SHA512
e6e249218c46bce48c4e807ef88a81149d456f01e1234d9081525a5f8cb8c0689502315be2ee8c0f5b56572fa696a6474917f34e896f14b9b367feecd44f04da

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
Filesize
83.5MB

MD5
5e307b5182474dd37d18cd8ada1a0285

SHA1
4d70faf2e6e3b0b5a91ecf0470a42bb9afff44cf

SHA256
5f38b643d1adddd70ae034cb4dd6f567b267c04d7a77e51c6869718630cfee92

SHA512
e6e249218c46bce48c4e807ef88a81149d456f01e1234d9081525a5f8cb8c0689502315be2ee8c0f5b56572fa696a6474917f34e896f14b9b367feecd44f04da

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.4MB

MD5
13dc9f455543556daaeed3b918992789

SHA1
5c3d8aea2499fa402bc5951dada102ebb776df68

SHA256
1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

SHA512
8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.4MB

MD5
13dc9f455543556daaeed3b918992789

SHA1
5c3d8aea2499fa402bc5951dada102ebb776df68

SHA256
1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

SHA512
8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.4MB

MD5
13dc9f455543556daaeed3b918992789

SHA1
5c3d8aea2499fa402bc5951dada102ebb776df68

SHA256
1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

SHA512
8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.4MB

MD5
13dc9f455543556daaeed3b918992789

SHA1
5c3d8aea2499fa402bc5951dada102ebb776df68

SHA256
1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

SHA512
8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.4MB

MD5
13dc9f455543556daaeed3b918992789

SHA1
5c3d8aea2499fa402bc5951dada102ebb776df68

SHA256
1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

SHA512
8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.4MB

MD5
13dc9f455543556daaeed3b918992789

SHA1
5c3d8aea2499fa402bc5951dada102ebb776df68

SHA256
1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

SHA512
8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.4MB

MD5
13dc9f455543556daaeed3b918992789

SHA1
5c3d8aea2499fa402bc5951dada102ebb776df68

SHA256
1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

SHA512
8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.4MB

MD5
13dc9f455543556daaeed3b918992789

SHA1
5c3d8aea2499fa402bc5951dada102ebb776df68

SHA256
1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

SHA512
8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Filesize
18.4MB

MD5
13dc9f455543556daaeed3b918992789

SHA1
5c3d8aea2499fa402bc5951dada102ebb776df68

SHA256
1fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba

SHA512
8ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Filesize
599KB

MD5
d03d4c5ddcdbabe4666bc7a548d20ec6

SHA1
5055542c06e611e813de5c8ee98fde40b45e8fe7

SHA256
eb133cd63e7566b3314312704c194d61afcb1c642868f534d0c6a326f524cb0f

SHA512
163155b2ab0a6b9aeea5155f26467bc3660d13da3693592af3688cbe576ca49afdc655fb1fa372f8e2bff641e1c7c30a777dd344b393c552432104fea8578b75

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Filesize
896KB

MD5
7e0df0c11087dbd96d7e3211b27db0c4

SHA1
adf7da811387b31c6a9ef01aba792c696dcd7838

SHA256
4ee1cfae48ed47a7ca5315c64659385283a57accc1bc9ae24c5fe3d2d28c2603

SHA512
e357f6aa9a2ab1f09ceed4dcad9c62a252ae31c5797ff135aa8907221465f3d3709aa950b6ea995d66f238b2539661554e8a76ad931de18f4c8e7f67bc44f469

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
1.1MB

MD5
7b49c99fe56efafc81f9b1cf64671a78

SHA1
93f33c050541258777804da7446ce431b1601adc

SHA256
f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

SHA512
9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
1.1MB

MD5
7b49c99fe56efafc81f9b1cf64671a78

SHA1
93f33c050541258777804da7446ce431b1601adc

SHA256
f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

SHA512
9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
1.1MB

MD5
7b49c99fe56efafc81f9b1cf64671a78

SHA1
93f33c050541258777804da7446ce431b1601adc

SHA256
f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

SHA512
9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
1.1MB

MD5
7b49c99fe56efafc81f9b1cf64671a78

SHA1
93f33c050541258777804da7446ce431b1601adc

SHA256
f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

SHA512
9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
1.1MB

MD5
7b49c99fe56efafc81f9b1cf64671a78

SHA1
93f33c050541258777804da7446ce431b1601adc

SHA256
f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

SHA512
9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
1.1MB

MD5
7b49c99fe56efafc81f9b1cf64671a78

SHA1
93f33c050541258777804da7446ce431b1601adc

SHA256
f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

SHA512
9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
1.1MB

MD5
7b49c99fe56efafc81f9b1cf64671a78

SHA1
93f33c050541258777804da7446ce431b1601adc

SHA256
f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

SHA512
9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
1.1MB

MD5
7b49c99fe56efafc81f9b1cf64671a78

SHA1
93f33c050541258777804da7446ce431b1601adc

SHA256
f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

SHA512
9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Filesize
1.1MB

MD5
7b49c99fe56efafc81f9b1cf64671a78

SHA1
93f33c050541258777804da7446ce431b1601adc

SHA256
f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c

SHA512
9ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Filesize
655B

MD5
e77e36c159d1f61e434f060683728c58

SHA1
3937b77f65640880a9c9a96c73a254f1dc04b3f2

SHA256
7a56aa4b4ff4d8a5084dee026a2fb8704fb259d9ce215542bf3b3fc2506fea60

SHA512
6ac5a648eedd2f81f2fa12f940b018e44dc440d002fff6307b2eaff904be15bb9b08bfe148c4d90376b1f9347ed182611ee8a58eae27444cda43a5aad3655009

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
Filesize
3.9MB

MD5
497dca87043d7c5d5bf8a81c61435642

SHA1
ec0b37632af422e18f507ca1188433efe629035c

SHA256
0fed010750b6eec9ed7f2d07551bd53a355d07dd10b5a6d90cd4b00cc4229329

SHA512
71f61c26dd9a54afd48aac109ef9e6bb986ffbee5d7dd8a5c83ca5eef60dffb033ef63ba740914d8a38ca1642e3b19976d7f4103d68206adfbc28d1ad2f1dd83

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Filesize
10.1MB

MD5
2c367970ac87a9275eeec5629bb6fc3d

SHA1
399324d1aeee5e74747a6873501a1ee5aac005ee

SHA256
17d57b17d12dc5cfbf06413d68a06f45ccf245f4abdf5429f30256977c4ed6de

SHA512
f788a0d35f9e4bebe641ee67fff14968b62891f52d05bf638cd2c845df87f2e107c42a32bbe62f389f05e5673fe55cbdb85258571e698325400705cd7b16db01

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
Filesize
372KB

MD5
2b1132fc8f12d4fa3ec68a3293f22d0a

SHA1
ac25afab91399f79e8e6138a0290f1513020571a

SHA256
b424b7ad12aee02a9de5b6b740ee962df760de6f0d1f04e353ce1269dbf7403a

SHA512
fef1c6b0ae2829b4aafd12d046aa9506c4df6d4be6165167cb13aaadd3682ef72746ee9aeda40b8acc56691888f36f1005b6b85d161a6b32c9a0fa7730753029

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
Filesize
6.2MB

MD5
9933cb0b99c9651de7832d8fd05b1de0

SHA1
0e5ddbfbc1f0788a9fbc57e751c8b9ce7e8ec18b

SHA256
262e337d30ba6c9a64d357ac6511856dab4b546ed47114f509de6f37451134a0

SHA512
b6f061133a8f7b6edb3287a08e300fcae0b8cee41cee25facb81a4a297e8e3c0e17aa9348c35a6a5cfffaeeb2d8f2205fc7a1ff25a376c699769221cd4505de2

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
158.4MB

MD5
15529475ac91826af75d06b6c1ba1ecc

SHA1
3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

SHA256
cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

SHA512
f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
158.4MB

MD5
15529475ac91826af75d06b6c1ba1ecc

SHA1
3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

SHA256
cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

SHA512
f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
158.4MB

MD5
15529475ac91826af75d06b6c1ba1ecc

SHA1
3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

SHA256
cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

SHA512
f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
158.4MB

MD5
15529475ac91826af75d06b6c1ba1ecc

SHA1
3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

SHA256
cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

SHA512
f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
158.4MB

MD5
15529475ac91826af75d06b6c1ba1ecc

SHA1
3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

SHA256
cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

SHA512
f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
158.4MB

MD5
15529475ac91826af75d06b6c1ba1ecc

SHA1
3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

SHA256
cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

SHA512
f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
158.4MB

MD5
15529475ac91826af75d06b6c1ba1ecc

SHA1
3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

SHA256
cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

SHA512
f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
158.4MB

MD5
15529475ac91826af75d06b6c1ba1ecc

SHA1
3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

SHA256
cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

SHA512
f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Filesize
158.4MB

MD5
15529475ac91826af75d06b6c1ba1ecc

SHA1
3d8bc5e0e800e90ccfba6c6195843e0803b9fab4

SHA256
cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91

SHA512
f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll
Filesize
372KB

MD5
2b1132fc8f12d4fa3ec68a3293f22d0a

SHA1
ac25afab91399f79e8e6138a0290f1513020571a

SHA256
b424b7ad12aee02a9de5b6b740ee962df760de6f0d1f04e353ce1269dbf7403a

SHA512
fef1c6b0ae2829b4aafd12d046aa9506c4df6d4be6165167cb13aaadd3682ef72746ee9aeda40b8acc56691888f36f1005b6b85d161a6b32c9a0fa7730753029

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll
Filesize
6.2MB

MD5
9933cb0b99c9651de7832d8fd05b1de0

SHA1
0e5ddbfbc1f0788a9fbc57e751c8b9ce7e8ec18b

SHA256
262e337d30ba6c9a64d357ac6511856dab4b546ed47114f509de6f37451134a0

SHA512
b6f061133a8f7b6edb3287a08e300fcae0b8cee41cee25facb81a4a297e8e3c0e17aa9348c35a6a5cfffaeeb2d8f2205fc7a1ff25a376c699769221cd4505de2

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Filesize
364KB

MD5
d3368f2e6b469fda055af7a24f4fdb02

SHA1
841573fc67ca72cd2f37a89d5c8007fa8de0c6f1

SHA256
81140417f3299086fc358f946c49b96d24bcaff0c09baa3292e24a8b361c0813

SHA512
96811790b03ed2044241aa9d62069bdfde1bdaa94457c2cb86befc4c29f4db966fb27a45d94349c0110d19d9060fbb916a48fcfe5a517052a4d4fb384cf5922c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Filesize
13KB

MD5
159d3901f386388df374566fb6fcd622

SHA1
7ef0b2b651a7bdcba44efafb5e67b922d447f198

SHA256
e531925d86eb4f14ff09675bebce21a5ab6301ab139052f0514752e8ea346a19

SHA512
c951416ccfca17a533719e00d244844469a35dd7c6b1b21ad24daa400881b265750d97039c7e7f37e5d058b92402b1a016ca57315adb89627e0692330bc3282f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Filesize
7.3MB

MD5
d74731ce9b252737721129bb55970598

SHA1
18d25adbe1c2c808d71ead465281bfe3a1d637d0

SHA256
d9bc680a02d25144c143ff6825ae8f149c9abf85f3894e975de6befed28bea0c

SHA512
c64bc65632fa523c63bf3843374779d004626c7f121115234b48bcddd56fc731fd11b62c2934f3b6174e6a1df7feace46f9db5335c9add46e3fbc3bad5e72f09

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Filesize
590KB

MD5
10409a90206eb4859d27095aebf4c392

SHA1
2a9aa6951c923ccb5ca25348e161ee8799985e7b

SHA256
2de3925cba036e1eec21eccd40c35e501958938cf9f96bd125e145ba12c446a2

SHA512
96d7d065ab39d9a1e7850eeb6d23df9da5b0f6e91ea5c6258a06cef3d39c5eeded3117e83cbc1d0a7b0ed73dc656ef0d2b50651bb99800902186b4f1fb1cfd8e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Filesize
4.3MB

MD5
4fed87a14384c86689d69875d0c6f9a6

SHA1
d315cc38b3703bc9935cd5d9604e6ff775243d2e

SHA256
203b35ef27ca4bdeb8e241b1b58318234460e5ffaeb030f598eacccf542b2552

SHA512
28614b9516c633a52391ebbb848994d6f23b2720d2e168351648a9625f581b2ae9274be892f1c891d982222ecbcfeb34f3c2d596f63231541eb4dd57bf14c9d7

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Filesize
4.3MB

MD5
4fed87a14384c86689d69875d0c6f9a6

SHA1
d315cc38b3703bc9935cd5d9604e6ff775243d2e

SHA256
203b35ef27ca4bdeb8e241b1b58318234460e5ffaeb030f598eacccf542b2552

SHA512
28614b9516c633a52391ebbb848994d6f23b2720d2e168351648a9625f581b2ae9274be892f1c891d982222ecbcfeb34f3c2d596f63231541eb4dd57bf14c9d7

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Filesize
4.3MB

MD5
4fed87a14384c86689d69875d0c6f9a6

SHA1
d315cc38b3703bc9935cd5d9604e6ff775243d2e

SHA256
203b35ef27ca4bdeb8e241b1b58318234460e5ffaeb030f598eacccf542b2552

SHA512
28614b9516c633a52391ebbb848994d6f23b2720d2e168351648a9625f581b2ae9274be892f1c891d982222ecbcfeb34f3c2d596f63231541eb4dd57bf14c9d7

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader_icd.json
Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll
Filesize
782KB

MD5
a7d7a64dd61f1b7772d4f3f2fa0e51ea

SHA1
55076ac2dbdae4677cac689af29a9ec0277aa2fe

SHA256
bf77cd8a299afdb7a259626423b31f4c4ee7674de5d57e1ba858f79d3ac8af15

SHA512
1940243ecda51d47aa69b0ae453d36a16d5ae1e22acc2dabce58058c5d0af4f9f4d17b09a95b25e2fc81f3b329dbb4d781c647d731c293ebd5207466dc261ec8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll
Filesize
782KB

MD5
a7d7a64dd61f1b7772d4f3f2fa0e51ea

SHA1
55076ac2dbdae4677cac689af29a9ec0277aa2fe

SHA256
bf77cd8a299afdb7a259626423b31f4c4ee7674de5d57e1ba858f79d3ac8af15

SHA512
1940243ecda51d47aa69b0ae453d36a16d5ae1e22acc2dabce58058c5d0af4f9f4d17b09a95b25e2fc81f3b329dbb4d781c647d731c293ebd5207466dc261ec8

Download Submit
\??\pipe\crashpad_4376_CYVAOUVLXVERZCHB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1332-528-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/1332-538-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/1532-546-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1532-555-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1532-551-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1532-552-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1532-553-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1532-554-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1532-556-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1532-550-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1532-545-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1532-544-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1532-543-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/2288-478-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/2288-438-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/2396-339-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/2396-476-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/3276-398-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/3276-477-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/4288-421-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/4376-323-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/4376-474-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download
memory/5024-422-0x0000000000400000-0x0000000001690000-memory.dmp

Filesize
18.6MB

Download