7a2fe2a78359d2c3d16492187841049cbfbf4185a2fe9ce6802c72ba0b9dfa6c

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240221-de
resource tags

arch:x64arch:x86image:win10v2004-20240221-delocale:de-deos:windows10-2004-x64systemwindows
submitted
25/02/2024, 21:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spotify Premium for PC v1.2.21.1104 [No Ads & Premium Unlocked] - (SpotifyGuru.com).exe
Size

992KB
MD5

d3368ef12e3fa29dae69112bc1cae347
SHA1

9d4e9f65996e5e3fdadea22feb3e04f948c4de58
SHA256

7a2fe2a78359d2c3d16492187841049cbfbf4185a2fe9ce6802c72ba0b9dfa6c
SHA512

6d5fe4079eb9ed0268ecc140f792bd179005a9ba276a43569164cdb5feba3471612b11737081731c893e93bf21534569fd6bab1c5292c750da53ee7f415b3d70
SSDEEP

12288:NKmZUzzNgnXwd7QHUGn9f5xovK7hWYhK49gElg3/mOdHWEICdxZOh:AmZUPNhQ0Gn9f5xXhWYU45a3/nW6dyh

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Control Panel\International\Geo\Nation	Spotify.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Spotify.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping2548_1596686197\_platform_specific\win_x64\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping2548_1596686197\_platform_specific\win_x64\widevinecdm.dll	Spotify.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping2548_1596686197\LICENSE	Spotify.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping2548_1596686197\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping2548_1596686197\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping2548_1596686197\manifest.fingerprint	Spotify.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\display.PNF	Spotify.exe

Executes dropped EXE 9 IoCs

pid	Process
3508	SpWebInst0.exe
2548	Spotify.exe
1604	Spotify.exe
1496	Spotify.exe
4572	Spotify.exe
1396	Spotify.exe
4180	Spotify.exe
5556	Spotify.exe
5324	Spotify.exe

Loads dropped DLL 21 IoCs

pid	Process
2548	Spotify.exe
2548	Spotify.exe
1604	Spotify.exe
1604	Spotify.exe
1496	Spotify.exe
1496	Spotify.exe
1496	Spotify.exe
1496	Spotify.exe
1496	Spotify.exe
1496	Spotify.exe
1396	Spotify.exe
1396	Spotify.exe
4572	Spotify.exe
4572	Spotify.exe
4180	Spotify.exe
4180	Spotify.exe
5556	Spotify.exe
5556	Spotify.exe
5324	Spotify.exe
5324	Spotify.exe
5324	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1392040655-2056082574-619088944-1000_Classes\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
5752	identity_helper.exe
5752	identity_helper.exe
5324	Spotify.exe
5324	Spotify.exe
5324	Spotify.exe
5324	Spotify.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe
Token: SeShutdownPrivilege	2548	Spotify.exe
Token: SeCreatePagefilePrivilege	2548	Spotify.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
2548	Spotify.exe
2548	Spotify.exe
2548	Spotify.exe
2548	Spotify.exe
2548	Spotify.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2548	Spotify.exe
2548	Spotify.exe
2548	Spotify.exe
2548	Spotify.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe
1324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3508	2724	Spotify Premium for PC v1.2.21.1104 [No Ads & Premium Unlocked] - (SpotifyGuru.com).exe	93
PID 2724 wrote to memory of 3508	2724	Spotify Premium for PC v1.2.21.1104 [No Ads & Premium Unlocked] - (SpotifyGuru.com).exe	93
PID 3508 wrote to memory of 2548	3508	SpWebInst0.exe	95
PID 3508 wrote to memory of 2548	3508	SpWebInst0.exe	95
PID 2548 wrote to memory of 1604	2548	Spotify.exe	97
PID 2548 wrote to memory of 1604	2548	Spotify.exe	97
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 1496	2548	Spotify.exe	98
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99
PID 2548 wrote to memory of 4572	2548	Spotify.exe	99

C:\Users\Admin\AppData\Local\Temp\Spotify Premium for PC v1.2.21.1104 [No Ads & Premium Unlocked] - (SpotifyGuru.com).exe
"C:\Users\Admin\AppData\Local\Temp\Spotify Premium for PC v1.2.21.1104 [No Ads & Premium Unlocked] - (SpotifyGuru.com).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Adds Run key to start application
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.31.1205 --initial-client-data=0x3a8,0x3ac,0x3b0,0x3a4,0x3b4,0x7ffe9b95cf38,0x7ffe9b95cf44,0x7ffe9b95cf50
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1604
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/121.0.6167.139 Spotify/1.2.31.1205" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1688 --field-trial-handle=1692,i,17698772090650194118,12986090310777171015,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1496
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/121.0.6167.139 Spotify/1.2.31.1205" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3076 --field-trial-handle=1692,i,17698772090650194118,12986090310777171015,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4572
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/121.0.6167.139 Spotify/1.2.31.1205" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --first-renderer-process --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3540 --field-trial-handle=1692,i,17698772090650194118,12986090310777171015,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4180
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/121.0.6167.139 Spotify/1.2.31.1205" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3348 --field-trial-handle=1692,i,17698772090650194118,12986090310777171015,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1396
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/121.0.6167.139 Spotify/1.2.31.1205" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=4256 --field-trial-handle=1692,i,17698772090650194118,12986090310777171015,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5556
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --log-severity=disable --user-agent-product="Chrome/121.0.6167.139 Spotify/1.2.31.1205" --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=4276 --field-trial-handle=1692,i,17698772090650194118,12986090310777171015,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:8
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe8a0246f8,0x7ffe8a024708,0x7ffe8a024718
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1496 /prefetch:2
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3836823481102751021,13745635428709892294,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:6072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping2548_1596686197\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping2548_1596686197\manifest.json

Filesize
1001B

MD5
2648d437c53db54b3ebd00e64852687e

SHA1
66cfe157f4c8e17bfda15325abfef40ec6d49608

SHA256
68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806

SHA512
86d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4c957a0a66b47d997435ead0940becf

SHA1
1aed2765dd971764b96455003851f8965e3ae07d

SHA256
53fa86fbddf4cdddab1f884c7937ba334fce81ddc59e9b2522fec2d19c7fc163

SHA512
19cd43e9756829911685916ce9ac8f0375f2f686bfffdf95a6259d8ee767d487151fc938e88b8aada5777364a313ad6b2af8bc1aa601c59f0163cbca7c108fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
343e73b39eb89ceab25618efc0cd8c8c

SHA1
6a5c7dcfd4cd4088793de6a3966aa914a07faf4c

SHA256
6ea83db86f592a3416738a1f1de5db00cd0408b0de820256d09d9bee9e291223

SHA512
54f321405b91fe397b50597b80564cff3a4b7ccb9aaf47cdf832a0932f30a82ed034ca75a422506c7b609a95b2ed97db58d517089cd85e38187112525ca499cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ffe6b23e05aa4072cce95f7c606f2f1e

SHA1
e06e4e4987b4e5e8327af27dea11b2eee36a227d

SHA256
5292377fe4703d6ed818f9f4e9b74901cd443ceabf843a9c9a08cff85d287e6a

SHA512
0042002b6239af3272dd4e0e3288f2bef6b41e553b51e5faa70c743e0c767da85f8ec8a67290b8a54321ac1b1f306df38120cdbdc8529612f3385b0212076c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
962c1d57df32973b1489a5c1414a8792

SHA1
df4692b4ce2e954875869c2526aaf049420d9763

SHA256
d108e35b15695bfb19f42f54389daf94c27aba68a14f80439e0034722b5efb0b

SHA512
70193566cb26ea3dc654d920d7394f5ec7a60e83609505eca82c5c82bc80a45e6515d561669f0802eb580bd4ead88b9d79ce78ba79617ac9e7a393f0062175d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86a5c8f1f187c1bf756c0c374357b9b4

SHA1
9b49515abf4647015417ba1aeb50ebac1c7e66fb

SHA256
fc328ea2bae3db3c0b94596546c116df1014738e0b382886cd97dc80db1e1482

SHA512
ba16a9a8494beb26af3d769b39a3fba5020580f63592faf685b5a0c86893c2e643c425c324760bd83ad5ea13045d3b5324acbdc8cfde809b7e96b053d912209c

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
76036bfe66e3517d94a68f20f06bbdac

SHA1
dc0efb90481b68fb929dc11a555ec0743bb01049

SHA256
abae3406e0c927272245edf0b2cfd3704e3182e8c7f1a90b23cda8bcf3f7c488

SHA512
693d19dcdd55f53d811c46edc32dbd533b09f54fa0f5bc3f189fc39a57c1eceed45d357abdaf2091e44d1bec0e5d617b5b6ad64fd64162e90c99da3db94373d2

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
4fbd0c14459e5a60e636f07685c6adf7

SHA1
d1455bded3e406ce68d7b2841697bb66f5289dbc

SHA256
cfb882b924cfced03f2f2f6597db924650b467904bc9c016af23dc1ab4a7ad99

SHA512
aebbfa12c12c45d5cf48ab85588d0c1c3a602fb1f1f5275131da2c5d5c06c2465075e48760de3542c06c3262f017dc9954f5a1513ea1dc9b09166e203b766546

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\2def08d1-5d0f-46e5-9456-da9d4e67bca4.tmp

Filesize
1009B

MD5
b86da76ba5f79a445a8be4cbac6edc4a

SHA1
3fa45615344dd8ee670b2e1f064649791a32f603

SHA256
9a1f1447f5a8d33757ca00ca274a77681789133ba8072d83f0b9b1ed0ce939e5

SHA512
cd298469614413973972fede772f9293a74473faec6fcc2da619512f8bf21ca67cf2f46ad407270948a883c3a15be62b2f0a4599943bff85fd6181427099331d

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe58a11d.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity

Filesize
692B

MD5
390ffac216eec9ef457f11deb2a92f94

SHA1
753d4bb1317cea00a6277461267ab1dac615db5e

SHA256
15d22a12067605fcb4ecf7dacef82edadfe8c3c427de957f8f5cb199a58ca3b4

SHA512
bf8fa9aa68c328f8cf1fc97625a5ef8c2b730798d4045a11cb381801c65a62f020069dacee6d077a72cb16113040a47705fd7e626ba3650ad7d68603a9b42436

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity~RFe57ddfc.TMP

Filesize
692B

MD5
0e9fc958df7799a392e2f3955b16c3b8

SHA1
399fca86cfb59f402d31e4defea348f5a955ee95

SHA256
e54f892cb7f6263c24d42c629e213947be42dfba737b265b53ca1cc3b292d564

SHA512
3ff457fbff09052cfa1193d1f79e5253f7a19c651dcdb56250593af3ed3261614e6beedbc5b141f733d24ad69df001edca60f029e438f14877e8c631bc3498e4

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
738B

MD5
411739a98372d2a07ebe8a19dd07abcd

SHA1
c6a271f805249251c8778efa34dfd3208f0a5672

SHA256
a24a0b850a95cb1d66887e4219204ef96c32f19f04f7503e1fa8c0a38772981e

SHA512
b3daed7cd185a0ea75ba85aa66ac087b455116e29e7e672540a864a571dd7856524508ab257aafa15b2a4d414f031a53e834624eb09b04c3b3b876c3b51ec0c4

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
831B

MD5
fa2198df01102c19d86dbdacd08d4a18

SHA1
f349293f5d77dfd6c9482c98ef9a89c082f35e0a

SHA256
3b3cc6c00d9ecbc98dbbee26f72244fc9cd12ba41383bd231ac01e923a154266

SHA512
55b1499c8c43a9056b0144489f738a54a0e896336505e19a571e56125844cca9dafaaba05f789e718875fec8e8ed0848613a476695794706265bf6820f4bb5ab

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe57d39c.TMP

Filesize
529B

MD5
06361fa0ba69ecdb7190bff78c0b205a

SHA1
6e4b0d3c75018d0d9e6fc28d24e99009772c4047

SHA256
62df51a8055cc8e013d75763daf26f896f90a9094bada1b9c7cd47796f1768d4

SHA512
244928f7d98420cb04960542d537bafb023ea4a01094b7e22631f016daf5271734eabcc541bad3674bc0db684384597ee26d3096682da34bd22e1157a23474de

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
49419965e3bbb967ff6e2d0febd7e208

SHA1
9e87e826b0aa744b5cc195f9a51a0d8a1ed61133

SHA256
dafb60c080ccd0b77ad9e99a7307462749534a272cd404238bc6b9f900d83228

SHA512
b38b37052df89935070aa87b7711a0f66f5179c0acf788c8dd4f0425386b96f56643770a02bcce383122523c8b57e61446970a4b502a991669fe2ae83e4ae865

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
2.8MB

MD5
06d906d4f902e8a4b6205365316b45a9

SHA1
4d99bf7b7328b98290442fc1ce46103af41d6a75

SHA256
1803c2d877f4d35c66823e9ae9c97b0f5cac7d5e2892b88917e458df200c8849

SHA512
b2c8d269a285d9dd2b2e321d47cc08e0c5b01c11b46f5e081f7378be3666f81fc4a87ad08829c356a92fc4014fd7671fbdfd9a34c72424b919003b983fefb7b7

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll

Filesize
42KB

MD5
09c5e2da912996f25bddda78d8cd6b04

SHA1
f2cecba252d49b64a3685f26597e485159a9da85

SHA256
62345bcda5b68ca4022344b989534fa15fd99a029bcf63a16adbdaa820c1d563

SHA512
898981036f5507cd1009b47c29dc3ed56a96ed28531a70c9d7b48d015332250694a8d5a7fd5e7cbcf339c3fe4f671d8c561623292bd93672bb18304736e590d3

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe

Filesize
37.3MB

MD5
bb89c81f0ffde74a8a58cd7d2e837f6d

SHA1
807f808f6da39db7ec7022eb932a970bb5f29d03

SHA256
4a5f40c8917ac5b52aff60e13f0d962bada0a45b9f607167578356933570d431

SHA512
0e6509f6824ccc94010f03b6e8a34e4df2606485cac9a89bf4a5cf6f58c95f46d6e2e3a4f45578fe2cf517b5bb234eb2294337f4a63f2875eb5c2b29801b9839

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe

Filesize
57.6MB

MD5
7af20a3a783e41f8da59c4da7723ec12

SHA1
c7548439a28fc818833e5026365336ae3db317b0

SHA256
9598d6ab335a58abe8638f04cff5e81cd50718d3e505accae8f46ae9f5ee7a2d

SHA512
3acd8e41ba373f372365ad05a58bb79a8614a0240cf23d077eb28acbbfefea91fd803c80e9215849678ab4a7ae21884bfa6c451d48d096771fb8b182537509d9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
1.2MB

MD5
96836b5801faf51dbbee3cf45bea66a3

SHA1
4a2d2f12d5d77efbe22833ab9f1fe1d90718b785

SHA256
b1d1f3365d2c3914f99ea82febf55443d51433ec1c118cb25f3b79a2ca2222a2

SHA512
891384039cf141812392d285a95bca49ef09ed406d7f3c5d8de547fb35c2608d76023357d6e71aa1026ccf20ace1dab8fe2aa3ceb3647a47601cff7bd930d0d4

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
896KB

MD5
d2ed18703786c5fdcc3c5c923d83b4c3

SHA1
ec0593d9c82b749e5c44b58d9b091599e8e81e6a

SHA256
21df028b2e3a71b603a0e4430d2ada7b8ee34404b961da27116819def3f03132

SHA512
7e9bebbe27f61fe346a764d3120954d1215c508ad4c032a9872e270ef93cdbc7c2f8a6b958a6688cc448f640231f01324992a6977b60fc76435fa3d6cb31f05d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
6.2MB

MD5
1f009ffa7ad5717c64f7271bdc58b54e

SHA1
50f38bd1eab2044454bdcfedd84168a79c6feeea

SHA256
040198fd9e172f4ce5fa25f5577765c941f7c277a9183edfbdf1cdac9e4ee016

SHA512
42cafdab95768f6aa5ab8afe0c1520745965e8beb555e9443d5d580d4ac89f51e08129e4fa63672c673bf09310e9f62c05dda415221f5153339a9aaefc213791

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
512KB

MD5
fcc493fcb46b7cd0414381e9372f5298

SHA1
749c8f64511c79fc98f1353b3c7cf1cbb4f79b8a

SHA256
cc4cb02f6a68ae3035eed2bb08abb6607a8733f687f8398d4d6d53311e127859

SHA512
d9a959ba8b8edc9f4aad555d4af0e0dd6fae07a1c5a70f5a091f66bbbb24faed988c3b5ce2c6c75d6a170c80565b0d19dc49b676212382808ffe2b40fd2c143b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
2.7MB

MD5
7dad9ade8741e204ad9976d13f7df262

SHA1
c3c9e7569e85e49871695467fdc2826db7c6e896

SHA256
2e6ac925915eb0b0a6d45b14c1773c3266891985f9e88c213c01016c681db2a1

SHA512
b3ccea0ca4c4cf11bfaa62c49d689a1e7c9f50498a532cf3a1073f09c3c3b7bf6a9f4f7e3599914cf09a1a0f4bf56368de2d94535a6317a05d65ba47c88f6ac7

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
256KB

MD5
4a6bff329557dc9923ed99f7236c7c84

SHA1
0908b9b793c30bdf0a40fe1d3a48a9a39985feeb

SHA256
709b08490806a50c9946a613df1ef998def3eb865962fd1350599094d544dc7f

SHA512
e7129d1e1e2b6f061c4ade784ee9bb94cf11cb133a4497ac5254b3b6f94fb4a90e520dd2b527bf7c77d6948c15e1b98a71166d935fa9597389b2e85cb6d2df27

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
128KB

MD5
663462e903f974aca736415c81c8b620

SHA1
b734a14778fa284181214b2582ae42440c538bc4

SHA256
04302860444cb757aca550f7a7c2d5ed9d3292c01ce17227d3418ddeceaf968e

SHA512
1556799b6c9a6790fd447af34e45f9c786f7ef2f68c24d685b2e8cc018e6dddfe270eecf6227a4568f7a47cc262b77c60993200b7b6eba6f1dcb0000aaf5215e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
5.2MB

MD5
f97c6b52e8040837626de0a9506ba058

SHA1
72e9eaaff5c5e47db619a33649ff3f85db5995fc

SHA256
694b5f842bf4f5194e3d7f05776a1f84af44dc8d8135e9b6112451550bcd7e00

SHA512
bc83c6e468f0e70f269560a32355e1b37c5212052affd549b796a2d88dea52f50882046d3039fe79eb0070ab4583211ceb8c3bbbee84fc4be42b2347f9f6fa78

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
1.5MB

MD5
9b9e5e9143f43ed5ecd000229bce2182

SHA1
4bf9c4a4fb9cfbe3adc7217782277b1cfbef10dc

SHA256
8acb1410eca2021e16dc752b9311ed7b4639daa61a10b88b9301046f9ef209fe

SHA512
916dea8d2029a9fec96b6db460c1ede880620a06ef1b70dd1aa047cc9358b5f420b355ca4ce72fb12883559d26227c2704cccb99ede07d584eb56d29e2668806

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
723KB

MD5
8769ca49abae6664f018947546577d16

SHA1
26805c113867845a210fba76dc089967f4e28e0e

SHA256
7fe5c8576bdca841ac43598eb50fc872a0f8562e49f831b872bcfba877beeadb

SHA512
feaf9052a72ef519d596214bc5159c0c0b34989a8d36c588c267799fecf5b027f01434e1d574bc78ad007afe213f08b91bdc7b24ba5161363ad002c02d579869

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.1MB

MD5
3b497bbad96f8a9af62fa902060137ec

SHA1
c05d50c38889ea58c0212068586b4a3109146257

SHA256
dee588f6e81c62d0172dab400ee8860d30a619354c5815718e20975c26ee689c

SHA512
c76647be62de62822b3aeb8782c1fe258b4cc1751540ba0f8f1115398af9c931da9c3a7d2bd530209f6ed521ec6f2056330a885d2c465744a93784300cd855fb

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.4MB

MD5
544bb441fad49b76f4998907d2bd071f

SHA1
f53d60c686471bff87ddb39ae1f0b726013928bd

SHA256
5ad765368ec8904c8d61e1ae507786ad0f3842c1cb7afae4147ed8f82361b6a1

SHA512
9346577f988a4576b000f075c412a40405a9e8d6543e2836b6c59888a47a4b094ff0ed0a85e33e0b0a72c0709488be68a27a17c188f562e6b2090caf94ca279e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
64KB

MD5
1aa0b70c947e74d15ef62bce10614610

SHA1
0bd9960b2c310cdc0cda160d54653caa7ccc3ac5

SHA256
69a0edc9564d202c1068165e2e05663ae12abbce6cb596598753df3c827d584b

SHA512
8329d650830408716db2dd19993e8df2710b4f4b2a44c08bcd339f9053eea25813d36477b6de3285e87c779d987674bd8a3ca29d98fdb6d37b860ec1a2abae6d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
128KB

MD5
a9fc189cc1562ab5d472b7d6ed94a91f

SHA1
94e69346f838ef943f424aeb6e768c9b78b1830b

SHA256
787901ae27d1eedd8f9d63e0f90fa903df8eb0b9262566516ff6f247c88a7113

SHA512
df3540d2e8575cf686da1d24ffe22f92584f5913b2f8d151d017617b963cf53c8f6637f9034cd92157a9c259225d22a6f0c1032fe24dc1224d854266486634cf

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
ded0f0d3abd448b83b13b668270c1f2c

SHA1
3ffe85533a8aedc253fc62e3cead832e1a2376cf

SHA256
95599fbd5dd5da075486ec8546767386cfdaa252f95a95199f3f2aa3560bbfcd

SHA512
c6531d95349f70d75a551de39ee37b88f99765436d2fbaea5dc6fa8faaa70799b4a37953dd41fb825bc5b3f2eaa50eb8b3187eb2c88ebff395e5124b0053fd8d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
682B

MD5
34d129dafd5b37eb13bee55abb256d17

SHA1
2467f3c162b0766f237d1f604ab88285bfb6aef0

SHA256
ca8fca68d1115503e0f54c7cdd6f998d1f2a7a370fa794def287cb41fdc3bf15

SHA512
0d512a84ad71dfe3148b0e9ca2ceaa728c591be87910583ec1ffe454d4746f9672983051c3db1baa08aaed0d9d7f27bf0ba6becd27b2ae23b3efcb6be1f7dbdd

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
1.5MB

MD5
54287594f6966922bd6895d1d02b3f44

SHA1
5f5786d1c89a8bbdab6c8d84b50060113f72c2a3

SHA256
3ebda320bc6f32f240211692931caf9614df24af343a9b02886c974e7364144f

SHA512
5f1595bddcabe406457078b62b1251318e1fe30a21c814441778f5b76f3e00bcdaa8db9c5d0fd5b55719d5edc1c20f778ef51a210580d113b84dc364afc0a04d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
6.1MB

MD5
a09e75a7aba33bfb2ed180e26adeebdd

SHA1
255e7029be6424645f62f1de922bcead89b856cf

SHA256
41c1da26361f643f7c5898458fbd2096de6a28f6efa0f8ce01ec788ec6c89cbb

SHA512
ebc0cc1a9f84c90e38c75b3b7d696c5ab948176d06671a1a890a58f14a74dbb97cb85daf8be1c55f73b91648131961eef7b6f67e88d080af8f23baf0995cb9dd

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
14KB

MD5
5228301dd43a314e049f072f7105a246

SHA1
f521ced4638cc39642c79ad787b676141cd8d2ac

SHA256
80e7ff8db698d0ad797234daab19655c71698ce6272089764028638440e902d5

SHA512
4c578ce065c119f2619b9e1a97eb32f21e245f692f3c080d01b418738363f2b59b12ac6b352b116412b2e53cd111e90d24ab7ec952bdfceaf25abc8057fa87b8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
1.4MB

MD5
a23d477fae7c4b2c3a061eb1849f1b01

SHA1
52d35cf4d6c3374d2cbbddd530de447e37028ce4

SHA256
f6a35982561b28993efee6a4f96c073ed79578464fd837e05bbbf270857f432c

SHA512
f86cca6182f6f95e21cbdf3d871d407325280418dfce21979813dfd7fd632885c66089e7dabb2d741431be1e9ce47e858560562116bdc5856c6e3f082bd47252

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
6.2MB

MD5
30101ed1318c03c8bfb81ed73231a7aa

SHA1
55f0c443d235712fc1c61acefca7605b7b385b55

SHA256
1fbc8f01e051682ce0d3ff1c9d84b5cf42ff1345bcb2fe3c37a38dd01a8005d8

SHA512
81b58da0c70ee882d31a544ef48a455a1a8bb46f0388971c44175dd6fbb8a65c83d30cbc0bdc9cb70e777805bb9abf4995f785de446218faf84b763bad28c0dc

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
6.8MB

MD5
92cb43f1df686509985ab2df7210024a

SHA1
82ed7ac0d9126e5690cebf07506cb7c0caadc138

SHA256
ca130e74b57ac91cc5ad878c2bf51008a86fa6fa871b5d7f628824d291eadfed

SHA512
cea224df1f45d77d81a3fc8c524b9d639279872c0b59383ad882b3246ce85a5b256da0e573fe456398d820f25305da237ec7a0dc5e30d3c6641cbc7c009870cd

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
7.1MB

MD5
6114edfeea6590cd8b42224487a63d84

SHA1
a1c3e017d1dd0ec2bb5e251893013573e44584e7

SHA256
bf35d6b828b1d112b25a8cb86a94174736c6e437e6408ab3b3c8c281e2897e88

SHA512
06b5f4da38ebbd670aa4da2735dfa1eac2c4ea8401ad7ab8d327d9d04df58077e04fc42c9c4ff9d2911292eb44f28f66fa41fad570180a934636c28a8a6e3d2a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
1.7MB

MD5
1c430ad6922f8561a45827084da120e0

SHA1
1013861bcd5981f9b44002cde6a7149ee899430e

SHA256
fb7711577f74abfb9f9a61c2722ba312b2364468a1ca58d072268ee582d8e718

SHA512
766773c93ebf78965465787100cb2980a752df822533ae72ccda19300e168fbe1b4c5e5ff5cbfb7eb1292f6bbf3bc6a9274b6477660dba9f803291ffbcd0f1bf

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
3.3MB

MD5
c35782b73a8b1d0b8268fbced9762d4f

SHA1
31f5d254314d418fa25f771bcae0101189f75b11

SHA256
14edd1138e01efbfb20046d29a7afbf9caa73d90c6c5ac318545926d05c1bf68

SHA512
69a44e2048569ab4d10f964092b2c8279d5aa1a292f17dbc1fcbf983f80211c4ccfcfbac993c19c2de4671dd7a7621f2256eb37012121865e7e9569bff275749

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
2.2MB

MD5
4b80c3f604ab12aa8baf0457af8a8685

SHA1
2c1aa06ddb9cd4b60b13e03cf41fb72cc7325728

SHA256
79768d2ee57b8e1764ad5fe340147411b29152105369d0269ea903b79b81b713

SHA512
4e6b5349c89a61ab67a289ba7cd5895c1a24ab86ca10f49a7b3c798231e3e1cb8a6f6c055b55b6869b592bc91f30179fd1439e5b11cc677610dae0712dbaa19a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
1.7MB

MD5
60fa86dd974ee471846a32fe11203859

SHA1
c31c728d2d1ddd373bd2ec75cc7833b59a015547

SHA256
ff565351f25cf8e2d2cff45fa29a591ba0d28ab2c9bfd0d291ddb2228da51241

SHA512
65b8bab6d71a2fd6471360805d788a36d44af7cb4ff2d9fb5820cf0c7c8f57a699a5ff7bedf38533ca7204873299f4ca262eb4bf52389ac90be3a302f933eb4c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
5.7MB

MD5
a358c8d0c4a481d7d3e1d9b78cd64857

SHA1
85e374a6e03a09a9c8b0e4f56a99ef20d70cb096

SHA256
1999ba16900e658b84144a2085ae0254b84a1b98d150fdc4ebcc40d9eee26ba0

SHA512
46fb41578bfd27e1598910cca071630c8a297fbf0accc4e5896d8d096325552c8e4af5616659e8351ff525a7d9e64dc372044b39aa79a3214cfdb84cf00de91f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
1.1MB

MD5
1188e532fe5b2520fb820db59235dd8f

SHA1
1560801df49a182302da16b946217eed8d53c681

SHA256
0741317989a75692511b7388daec35780a3487cc559096765ca42732a6eb1e86

SHA512
48d66f12b55d337e75ee54d41f9de670ba3ba37e82fd7377b5c6130f5b0558e0918770d8d9a4b52c97e5bc44a391ee1740af29cba779559a2255ff2d40dc0a13

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll

Filesize
469KB

MD5
8eb84e35cc3b45c948fdd1eb8bda7dcf

SHA1
1867cde23dde19942c5bcce29f0ea9608ff5d8f6

SHA256
f3eecb54e76ee87edcdec34b48cd8324b2618f88b859e9fd2b2c2c2c431cb6a3

SHA512
aec400f9db644f681c3d20eebe6034adccbb9cced6f52b166a1ff2d024f530a87f6f61dacad5c36fc00062cec9f270718b1ae290e895e84083a0115240cf1db3

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
1.4MB

MD5
7b6937ab130a7bb6f24028b8d01b9bd7

SHA1
997ea84d3662dde886205e0680b85062f8183d88

SHA256
81c220b3512bd6687e5c626094143dec120721958594ca4afdea2d41af4cfaa8

SHA512
4ad6537e6c8dd13dd8e6a416d5f94d9efe7ef85904b78e574328bdddb7ba30fbf34ffc973d7d358bdd003225aad5c6336aa9cc2bbed8cffba9ec20ecaa0a9bea

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\de.mo

Filesize
15KB

MD5
b3eef2c855a719403fedb0f749229cd4

SHA1
43517d5501f5d26b8ff7a22761c6a086d3a7670a

SHA256
386b213ac921e12da695f2c83a84646bf1ee459023b616ccd88e7ab32a355c39

SHA512
6e54092576050404a230cf76f74f8ffd31336b8f4c587f0f39f74659bc6170444c03876b1ccee3ba015b3bbc576c1d215f2093c24fe8913f9bb5a5fa391fc1e9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
448KB

MD5
62cf97caa1e687a5fcfde34c4831ff20

SHA1
b72b9dd1ed2004967288e005997596fc99dc5f37

SHA256
e5c1d7bf50fda5013c333006a00a1a1725a06ddca4d77ff2506179f472645695

SHA512
95cace9b76d9ef82705b9572f534638f418c8fe8a7668a7d08503b20a19d471e76ae1ab0c8edb4af2b1b675d5ce38ea5981cac0077751542fe5135dcca79afd4

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
6.1MB

MD5
c485e54b091a2cc609d24a2458343a3a

SHA1
26bd3d338bd1d51f9bce54756c59f96ed1e89ea4

SHA256
f0a8dca10030d6af8bc989a55e866731439d852ee3b9c6004d5f6c7a24433340

SHA512
4b16a5785c62dbee5a0290ba1c44f9fe96fb0c35441d24d52f6973bd550f460d90cdd48febcb5510fcdf87f8d2b0e6210e0f5e6b535a8458f1c0a4630e7527f4

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
128KB

MD5
cd45d76f7f427ecefee4aeb6495694a5

SHA1
ea4e5fc06a433476d69c95c431e0c85ec52f76dd

SHA256
0ba19a648c5fc1b4ea93f94193baa1960de5051b8056b62890cd36387c1236a9

SHA512
a4cf55762089d1e996ce9ed527bb4e9bd0c1970a0bf2b68b873b998f6202f460e0f7d8aebd0f4dbb115a5fa3ad1eb87ef3a0db80f9e0e8dfaf006ad002b94a55

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
1.3MB

MD5
b1b6b6ce34462a441981bd52c33fa6b5

SHA1
41e488a29ee4a532bf32551b7659d8dbaf19967a

SHA256
5bf861f4aba242b804841396d3bb9529d1baf56bed8534f11e94dfe2113d8e55

SHA512
af2c06a9b54c4ff6f09f50894e92eebcf34e5970861d716c25168e96549eb916a2515bdeeda55e2ae4e77ba864a4f60f8fc4e23e3c232623c22879a03c574987

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
2.8MB

MD5
fbb138582219726eac245ce8d0369824

SHA1
c6477601ecbc51cb808b8dae75cd407b45ace809

SHA256
0d5910409cb055cbda56552fc91a2da8edde70f356bc386865bf2d51d827e2ae

SHA512
c0e8aff9cdd218d310b9a8c4df003eaa76896f4cf19c966c611cae401ac4f9a2940c8cce17ce309c646a9a9161b731856f77c4da6b5ef1c4d51542f1fa74dedf

Download Submit
C:\Users\Admin\Desktop\Spotify.lnk

Filesize
1KB

MD5
ecf2044742d17677c672f933afa135ed

SHA1
5a77bff6c6e506982cdd9721d1a0cce5fbcb1960

SHA256
105a856242646b7c13d17d46a74cedacde698320db30948f5f8cd74b5d8d57f5

SHA512
6e19781642a89a77167896e2c43524dd873189c57f98e72eb012539fe7d81fd16bd09c35ebf02c760a663fb6be4229f6c35b649d125e07773710f85199da833e

Download Submit
memory/1396-335-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/1496-435-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/1496-302-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/1604-434-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/1604-226-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/2548-409-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/2548-208-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/4180-450-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/4180-336-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/4180-358-0x0000017AD04E0000-0x0000017AD05AD000-memory.dmp

Filesize
820KB

Download
memory/4572-337-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/4572-295-0x00007FFEA85E0000-0x00007FFEA85E1000-memory.dmp

Filesize
4KB

Download
memory/4572-303-0x00007FFEA8140000-0x00007FFEA8141000-memory.dmp

Filesize
4KB

Download
memory/4572-355-0x0000012E47F00000-0x0000012E47FCD000-memory.dmp

Filesize
820KB

Download
memory/5324-577-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5324-581-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5324-574-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5324-615-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/5324-575-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5324-587-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5324-576-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/5324-586-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5324-582-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5324-583-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5324-585-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5324-584-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5556-518-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/5556-485-0x0000000140000000-0x0000000141D62000-memory.dmp

Filesize
29.4MB

Download
memory/5556-502-0x0000023B192C0000-0x0000023B1938D000-memory.dmp

Filesize
820KB

Download