fa7ff9975dce1fc26987f6457ee9ef5e9a9fbe4d21b68a34941343f5cb00651e

Analysis

max time kernel
54s
max time network
67s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19/09/2024, 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install_New_theme.bat
Size

277B
MD5

bf78a0583ee16de7cf3776c7c7ad23fc
SHA1

30d6cf358f8932007554e5a5ef2f3ccf83c90e8a
SHA256

fa7ff9975dce1fc26987f6457ee9ef5e9a9fbe4d21b68a34941343f5cb00651e
SHA512

8a154d83996fbf0ba5f3c13514c48484824238d5d42aa7bcb44e399b996c249b66edaf722080101db0a7b4e8b93ca6028ac27ef565b9dfc7169d62466cf8f5ab

Score

8^/10

discovery execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1552	powershell.exe
3	1552	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1552	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1572	SpotifySetup.exe
2244	Spotify.exe
2752	Spotify.exe
1936	Spotify.exe

Loads dropped DLL 2 IoCs

pid	Process
2752	Spotify.exe
2752	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpotifySetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe
1552	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeIncreaseQuotaPrivilege	1552	powershell.exe
Token: SeSecurityPrivilege	1552	powershell.exe
Token: SeTakeOwnershipPrivilege	1552	powershell.exe
Token: SeLoadDriverPrivilege	1552	powershell.exe
Token: SeSystemProfilePrivilege	1552	powershell.exe
Token: SeSystemtimePrivilege	1552	powershell.exe
Token: SeProfSingleProcessPrivilege	1552	powershell.exe
Token: SeIncBasePriorityPrivilege	1552	powershell.exe
Token: SeCreatePagefilePrivilege	1552	powershell.exe
Token: SeBackupPrivilege	1552	powershell.exe
Token: SeRestorePrivilege	1552	powershell.exe
Token: SeShutdownPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeSystemEnvironmentPrivilege	1552	powershell.exe
Token: SeRemoteShutdownPrivilege	1552	powershell.exe
Token: SeUndockPrivilege	1552	powershell.exe
Token: SeManageVolumePrivilege	1552	powershell.exe
Token: 33	1552	powershell.exe
Token: 34	1552	powershell.exe
Token: 35	1552	powershell.exe
Token: 36	1552	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 1552	2788	cmd.exe	79
PID 2788 wrote to memory of 1552	2788	cmd.exe	79
PID 1552 wrote to memory of 4524	1552	powershell.exe	82
PID 1552 wrote to memory of 4524	1552	powershell.exe	82
PID 1552 wrote to memory of 3852	1552	powershell.exe	83
PID 1552 wrote to memory of 3852	1552	powershell.exe	83
PID 1552 wrote to memory of 1576	1552	powershell.exe	84
PID 1552 wrote to memory of 1576	1552	powershell.exe	84
PID 1552 wrote to memory of 3140	1552	powershell.exe	85
PID 1552 wrote to memory of 3140	1552	powershell.exe	85
PID 720 wrote to memory of 1572	720	explorer.exe	87
PID 720 wrote to memory of 1572	720	explorer.exe	87
PID 720 wrote to memory of 1572	720	explorer.exe	87
PID 1572 wrote to memory of 2244	1572	SpotifySetup.exe	90
PID 1572 wrote to memory of 2244	1572	SpotifySetup.exe	90
PID 1572 wrote to memory of 2244	1572	SpotifySetup.exe	90
PID 2752 wrote to memory of 1936	2752	Spotify.exe	93
PID 2752 wrote to memory of 1936	2752	Spotify.exe	93
PID 2752 wrote to memory of 1936	2752	Spotify.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install_New_theme.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "&{[Net.ServicePointManager]::SecurityProtocol = 3072}; """"& { $(Invoke-WebRequest -UseBasicParsing 'https://spotx-official.github.io/run.ps1')} -new_theme """" | Invoke-Expression"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -V
    3⤵
    PID:4524
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -Is -w "%{http_code} \n" -o /dev/null -k https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.46.462.gf57913e0-290.exe --retry 2 --ssl-no-revoke
    3⤵
    PID:3852
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -q -k https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.46.462.gf57913e0-290.exe -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-09-19_13-28-14\SpotifySetup.exe --progress-bar --retry 3 --ssl-no-revoke
    3⤵
    PID:1576
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-09-19_13-28-14\SpotifySetup.exe
    3⤵
    PID:3140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:720
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-09-19_13-28-14\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-09-19_13-28-14\SpotifySetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2244

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.46.462 --initial-client-data=0x458,0x45c,0x460,0x454,0x464,0x686efb8c,0x686efb98,0x686efba4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1936
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.46.462" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,11126476622923347513,3795273834198858780,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  PID:3676
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.46.462" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3252,i,11126476622923347513,3795273834198858780,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
  2⤵
  PID:3872
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.46.462" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3604,i,11126476622923347513,3795273834198858780,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:11
  2⤵
  PID:1696
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.46.462" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3676,i,11126476622923347513,3795273834198858780,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
bccaf1049a099d8b2a50982a86674d13

SHA1
1ba75c6fc26f1b5f20b672a5a9e31cd9b404f488

SHA256
4e05903306afa6004fb70302c7db69a8b8f24b51179622bfdd51f3e7376b64c3

SHA512
be4d2a83b42316620c0d2bcd604d053a08cf22d6e05bac73c774eb5ae413c7c5bd06964bf3888b80c4a35257c85337df3e822a1d6da0d4c17ea8ed4b43984a3a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fib5abb3.uyg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
3.5MB

MD5
d77dcc1e08d94254d2175ea9351bf251

SHA1
37aeb37e4e41bee58984b6635af7e16074510eac

SHA256
eef773e703bf729d4f30efd801b52696bdd054be0349fe767605dae7d7551f56

SHA512
1fef68f8052def00e619013de01f63c487f57a8f010959922752cead11313898ae764e72df088c4aa052ec378e3947539648171f4a532b8259d6c251d5aac637

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
896KB

MD5
da7e473c7a0bdf6a8bb9a55c8fdc4f04

SHA1
9a4d358d4df75389afa8e039b0cbcb049d080d5a

SHA256
7997f80ef953b511ba0efb87ae586eb12ad45e8cc8f6653431e7df429be36f18

SHA512
084b25343087c482cc4d7da33cf6f2ad1e3639bc88ba63b85374bec221d5d6fb04a5a5d94c4e251b4b274cbe5ba942a723b509b004467cb51abf8c8d3daef576

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
1.4MB

MD5
aad613bdc320343972641fa0ab662e2b

SHA1
06e53208a11347f258e98f2c03fb184090d14e74

SHA256
573d15c0c97aca1aec97a4307563f50f2684e7de9fb22c2747f36d0e95f32056

SHA512
c0695c0fabc5dbb59bbe825dcd15fd6973b4e83642dd1810f4bff4c1c6c87504f34a052480c96cf7e83aa3446c7b645c9c563a9d1dcb539099e0c2585fa4950d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
640KB

MD5
d47ed170ece14cb4a94d2860fc8e5c37

SHA1
2ae79cf193e3a09dc59e35276b82f8f29460e574

SHA256
0371e50ccd4ebfd3e9d44a19e9884b3bc99f6e8bd8c4319b251a337e1b5831fe

SHA512
dc39a9efea4f44473774b0bf68e729feb5d2b236b6a0f9e72a045149ebc0957bc55c51facf4ae557cdbb0115e60c250dcb162842af82cdf0f3cffdcd125667a6

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
26.2MB

MD5
e07767b6ed9e6ee625ef3f7a2b82d87f

SHA1
5340cff6c742009c1887a9005f0c068c29c48dbc

SHA256
29a0b72792522e9dea170527ede9ebc909ee84d0c6a918cb66098bf1fea645c8

SHA512
574cb1dcac9c0be3cebc2586e875a69ba495bdbf3a687cac75a11b0797e59ddd2ad6b4f6ee1ae1aea11ba45a75035701c3992843042d9fcb53add3b6a3123589

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
26.2MB

MD5
797ff9cd5191075d37ad2f9b767514c7

SHA1
64dedfc2e2a52ececfa50597dbe3e538054610aa

SHA256
1fc98041f934546617fe0c95dea87622946e21dc69710e071345db42b23d9844

SHA512
2629886f4cbba5e676ce104863b96e13a015e3ef1801ad8825b16ae6c8fec143201c977985b3446db02647a263c0d408afe621ffbaa846834cd1fa90a7574078

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
26.1MB

MD5
61d5a66a38e8a1d8a93db208c344b2b7

SHA1
4d62d41e964470a1d7c37ec27cbb994f8b578197

SHA256
739e27cdea7bed6cbe14cb8d2d31bbc6a01cfc318de77a0620a843da2e45612b

SHA512
6993e9baaabba668e3bd3beaca3495fa5c78e28494a722df1b6649d4bb028d44fb5fd2b68d5b8ffc04a8062018441dfb52caee379270b9d2ddeac2ebfa4f8b88

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
25.7MB

MD5
2c9190c4216f5d2ec223f0ea94e07fb3

SHA1
cf7c0d3f82a59c8fab4bb03bdceee2abeb0b999b

SHA256
be23aa51c5c9ac1301698d3fbffae72f941b457d65a43664239f4d88a242db2a

SHA512
6a56b79fcf8623c286cecacca5f1e5f82b6395962f5346e5507901b906bef4d21691357c1077d8e02999b26cbd7f2b7ad4b6a66422cd4d0930f637d24e1db22d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
24.1MB

MD5
597086a6e01a99eabde61a6d65de5d15

SHA1
6aa62eefc09999452b751d7654f3bc08f415119b

SHA256
ce75aedd7abca15e0d8752aaea5ae7f86bf366a1461697a0ea24d521319af579

SHA512
365a25d52f464edf9fe4c829f34b5f2c7020e6ec4fd4d1734fe90cef74eeabb31bb20dfffa328060c705f5acabecaa07af743fa28034770c965e307bf4dbe057

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
23.4MB

MD5
51e8e5f89fbce7991c9edb75993fcadb

SHA1
b29a68bc9d8e08aaae2c4d1362ff709e2392b7bd

SHA256
b9186be8b855c1411898da3f2b39ea9ba849237a85e640ca2e5348cfd8554662

SHA512
0d8774942a2fe2f7a5aeeddf1a6461c664e539cc816e791e83079fcdfb0fceb96f39436afb0e91d9bab24edf55687d815947885052a754e17e52517b89ec6972

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
22.7MB

MD5
e80c94eb29c8b5ca861b0abe1584fe2d

SHA1
ccd6cd553c0a020efeeda7e374e2cd1b0d359ab5

SHA256
0dff3df431bad08ef2594292547abe9878b5447238403b3305eb30b13ba60ce6

SHA512
d35b56576b63bb99dd0387471d3a41579c9a75e19eb14bb95aa1ef5f2c5012e28fa31e4520bf83482e30041ecb0a86f1308b1f551c78124517e813e367607508

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
22.2MB

MD5
f0f1873e43eb01b3fb5cdb8ba3426443

SHA1
54ca6a5597bcc88e5e774ee25f9651f31c0df5dc

SHA256
f281fce4cd78f3bcde83a4b6ff00cd315e26975ca86795696bbf866de0193458

SHA512
6572b27c439ea5c66647f0337de71683e025396bee365d2dd58840c9c7b1aee5091976b9c8b04dad0fe83e87f435e4106823cee86a27e3bf36d47c26d6a8ba8b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
22.1MB

MD5
a8e85cc16bfd68464308ff66b4cb1042

SHA1
fff11749658f8ff27fdd47edd6a765a341d63e9e

SHA256
969b5df6515ca743a629930362098a18a625b9da3aaab9a8eeb4a801c721038e

SHA512
907f39ef7741b27622e68ffc5ec2dd1465dcc2cad40f33244179b3d88da8c1593b5ef14ec58a4e6db9bb1c31ff55617a773704137d548ee012bccc18e12fb3da

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
665KB

MD5
08d5b9ba6de2fdfeba949a500788d3db

SHA1
a501a28ab57cbceec7096fceea8f59adf1c49d56

SHA256
617368e617aa56193eec7b21a05edc3116314434cf490cba13109084468fab2d

SHA512
acd5305032fb6c4da5f594804e0c7253d8370c8dda9f709a2385daaa193261b0d0885394fbc888438b326d363992466e67c7ab1e620d89490ef2ad7942bcf11e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
593d0c686b7e657fe8fecb6f87793bfa

SHA1
c9364f2efd003e69e9e13a47c30ce41e0ae45c64

SHA256
65ea636b01f8deb739d65d0a2244f1e476efa9df06ea2bfe06cb3107dad465a8

SHA512
69cfc43e5038a9c52e78a443e8745c343844d5041c4780e1792f0ac9d5fedacd0d82e4805276f01ca0c9692f786ea8c1164c5bc36aafe94233b8883886478c73

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
986KB

MD5
882678776a1a03f1dc4deb93f566511a

SHA1
b9433aabbc43886dd656eb0649463964dce79333

SHA256
5a8f0747bc5b1dcaea03efb753b6112d7bffe55def4fb55cb5c4c73fd64ecee1

SHA512
0d6e349ec5daab533bc22675c6689d15cc52d39992cebb94017ba9638fb6abb92c9c3fae60f9170dd4425972ac4c2c89d34e4ea00e5089fff305f6e1f799932d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
603B

MD5
2910c5efb2be9bfa68779c94d393d5df

SHA1
c90de90d38250e67719650aab388b4434a6f79b9

SHA256
56bed68d24e78afa9d56c751e28c0fb035ccfe5b2fbfcb69af1579342cbf0bb1

SHA512
7ab30dd7646792565a281bc2934d6bb87ad73baa127e86771009efe27486e35735fb718fd65de16e8d88e801611585ab0ffa9e82b27ac9521a421460390d0a12

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
f649a24310441e883c6f054f354966a1

SHA1
414d40a4f3635e59a836d1924251144025a54f05

SHA256
4646981b0b69355904fab98868993d33b253b96424b674b949e14d30d3fd565a

SHA512
637ef4437c5aad8e9cbc539b9fab0eeb844af94e0fc00a8b095119f46fdb0993e511cf4bf8640f76e372d717b8b93fce9adb6b4c6adfff5003cb03d815e96d58

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
364KB

MD5
a05ba4a4c4a0947a03649add61f0a0b9

SHA1
6353b1b663a885a3b42929c2ac53f99082114be3

SHA256
9d3095897fe6e7d34f36b486e641c078ff61e20274d93e34e20e4f4717d2ff98

SHA512
fe523d689f60316cfe234e2103e2415129dc8936fa6a63d8f7471ab2185ce5ec641bf310441062fa78d638b741643a8c7e3b1c62cac3439194ea9066c2045abc

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
6.7MB

MD5
d986f471aefe3a92b7dd5ff66c4b18e7

SHA1
5b2e98aec1aea00d69cb572f607682d5cdf5fb6b

SHA256
861be5d1debe229adf44b0a67221c604d7a87423607d7c58ea197f980199624f

SHA512
82e4f3ac996b5dbf9e65c2d2e9537dab6fdbdc74b424710f500f4b535cd46f9f10540b2df987bc972031d69eac7eee151beb196dc8a6f76f2d60c8965358d61a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
473KB

MD5
47ef63cd09a805111daffbaefea61ae2

SHA1
fc16c4a01f07a84983eedf1b775a7e90a7462740

SHA256
486569377bc470c932424935e6d18f9cb752cae1d5d21d9aaedc5d0ee3ebee90

SHA512
86a99afce4a38ae65641a9f120fe90aedbe96fc389ec6c41b61442ccfee466d668e46c9bb7bb588d77ff1803f33ddfd18c3d80aa2be52412064b079913e0018a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
e67df29f9aef1fcacd64aa11e6bf1579

SHA1
928f4dfea93433dbf772c3158522a1b2bfbc0169

SHA256
e269c4cb638b7fdb42462596157b5e6e77843bd60f36b58ba35ee40483fac094

SHA512
7a23994b2d1a33590e08b992c81ebf39551d4f3f278b9a4de9cbb09c7b87e0b578e5cda287d83ee89ac5af3f9e8db90c46d9faeaa0140cccf1ba0a33f9a83346

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.3MB

MD5
5272bdb104b38c8481e8946433aac159

SHA1
933997cc65745e7b90b2b711f9427a20fdb3207f

SHA256
5204d2ed8b2f2fd566955484696a40f25e3c400774073ae697f0472211fa2d7a

SHA512
fd1f0623f9c453538c3d792bba614075186b22f0c4f0851992d37846583a9b104bcdff2324afc3666f4a090fb7304f87753647066b394f80665ba7fe4b82a583

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
650KB

MD5
49ce10b6a6d1e4c9b4e769254190e33d

SHA1
2d8eb78c6c8a22050fd871a053e30137710a3cb2

SHA256
c87980632dc8b6a569041cf4734c555afbf3c87d22c17bb566d9dc7473292d6a

SHA512
5fbae605bcc72fe846aa8fd3bd6ed62804a8653623b871821d15584a8a210193f3e0e08f327664882aafe2042cc94733dc281f02d87752a528656e660f335e00

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.4MB

MD5
78bb99ca89ed19a065e5262226698a43

SHA1
b6c152d21f1300460b45f3eadcd57f4224ee0b4b

SHA256
9c0ac21d9b8898e43ded4810d2f643a2e355b901f1461ff4b901627dc5f18c2b

SHA512
c802e817bf2b0f832bc57f69ee9637da2ce23a6ef61cab870be5fa4f522f53ffc8f95057c9fb51e655303f4f6be953ea13ae45937c112334933ed62b39e7619a

Download Submit
memory/1552-253-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/1552-22-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/1552-9-0x000001D4731B0000-0x000001D4731D2000-memory.dmp

Filesize
136KB

Download
memory/1552-0-0x00007FFE8B1B3000-0x00007FFE8B1B5000-memory.dmp

Filesize
8KB

Download
memory/1552-18-0x000001D473870000-0x000001D473896000-memory.dmp

Filesize
152KB

Download
memory/1552-23-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/1552-17-0x000001D4733A0000-0x000001D4733AA000-memory.dmp

Filesize
40KB

Download
memory/1552-19-0x000001D473840000-0x000001D473867000-memory.dmp

Filesize
156KB

Download
memory/1552-16-0x000001D473380000-0x000001D47339C000-memory.dmp

Filesize
112KB

Download
memory/1552-15-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/1552-20-0x000001D4738F0000-0x000001D473904000-memory.dmp

Filesize
80KB

Download
memory/1552-10-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/1552-21-0x00007FFE8B1B3000-0x00007FFE8B1B5000-memory.dmp

Filesize
8KB

Download
memory/1552-11-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/1552-13-0x000001D473390000-0x000001D4733BA000-memory.dmp

Filesize
168KB

Download
memory/1552-228-0x000001D473F60000-0x000001D473F72000-memory.dmp

Filesize
72KB

Download
memory/1552-227-0x000001D473AF0000-0x000001D473AFA000-memory.dmp

Filesize
40KB

Download
memory/1552-226-0x000001D4747F0000-0x000001D474D18000-memory.dmp

Filesize
5.2MB

Download
memory/1552-225-0x000001D4740F0000-0x000001D4742B2000-memory.dmp

Filesize
1.8MB

Download
memory/1552-12-0x00007FFE8B1B0000-0x00007FFE8BC72000-memory.dmp

Filesize
10.8MB

Download
memory/1552-14-0x000001D473390000-0x000001D4733B4000-memory.dmp

Filesize
144KB

Download
memory/1936-275-0x0000000000B10000-0x0000000002566000-memory.dmp

Filesize
26.3MB

Download
memory/1936-405-0x0000000000B10000-0x0000000002566000-memory.dmp

Filesize
26.3MB

Download
memory/2244-224-0x0000000000790000-0x00000000021E6000-memory.dmp

Filesize
26.3MB

Download
memory/2244-241-0x0000000000790000-0x00000000021E6000-memory.dmp

Filesize
26.3MB

Download
memory/2752-261-0x0000000000B10000-0x0000000002566000-memory.dmp

Filesize
26.3MB

Download
memory/2752-402-0x0000000000B10000-0x0000000002566000-memory.dmp

Filesize
26.3MB

Download