xworm | 5041a474f1409fe971f2ee415cd67072f0f3e65fe15b720276ad9e8c14c37620

Analysis

max time kernel
1800s
max time network
1796s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spotify downloader.exe
Size

1.2MB
MD5

45de2e252c5ede9b5217d5958e9031f8
SHA1

d2082c95b96dbdf321fc506aad60c38842f28a6b
SHA256

5041a474f1409fe971f2ee415cd67072f0f3e65fe15b720276ad9e8c14c37620
SHA512

5e87dbe79f9c335b4ed4860eb7ed1b8363708454693308f455f5b52afb601e315500f41d81e22d51b969c6a0d48c1f61481aec9b1e57232a859b4b4455d8a23a
SSDEEP

24576:lveTmPpTg+S2/50+YyN1jcaVJOdLIhHBlpV0+jos+7EH1DLA:l2TJyLfJONIhHn0+jt+0

Score

10^/10

xworm discovery persistence rat trojan

Malware Config

Extracted

Family

xworm

193.161.193.99:1337

93.208.247.124:1337

93.208.240.7:1337

Attributes

Install_directory
%Temp%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c7f-16.dat	family_xworm
behavioral2/memory/2688-25-0x00000000002B0000-0x00000000002E2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Spotify downloader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 37 IoCs

pid	Process
1188	SpotifySetup (1).exe
2688	Spotify downloader.exe
3240	SpWebInst0.exe
1640	Spotify.exe
2688	Spotify.exe
2524	Spotify.exe
1368	Spotify.exe
4736	Spotify.exe
600	Spotify.exe
2812	Spotify.exe
1916	Spotify.exe
2412	Spotify.exe
792	Spotify.exe
4516	Spotify.exe
2104	Spotify.exe
2904	Spotify.exe
2356	Spotify.exe
2812	Spotify.exe
1692	Spotify.exe
4968	Spotify.exe
4752	Spotify.exe
3916	Spotify.exe
3048	Spotify.exe
4828	Spotify.exe
4704	Spotify.exe
1568	Spotify.exe
2184	Spotify.exe
4744	Spotify.exe
3604	Spotify.exe
1380	Spotify.exe
4532	Spotify.exe
5084	Spotify.exe
4760	Spotify.exe
4412	Spotify.exe
524	Spotify.exe
3496	Spotify.exe
2652	Spotify.exe

Loads dropped DLL 64 IoCs

pid	Process
1640	Spotify.exe
1640	Spotify.exe
2688	Spotify.exe
2688	Spotify.exe
4736	Spotify.exe
4736	Spotify.exe
1368	Spotify.exe
1368	Spotify.exe
2524	Spotify.exe
2524	Spotify.exe
2524	Spotify.exe
2524	Spotify.exe
2524	Spotify.exe
2524	Spotify.exe
600	Spotify.exe
600	Spotify.exe
2812	Spotify.exe
2812	Spotify.exe
1916	Spotify.exe
1916	Spotify.exe
2412	Spotify.exe
2412	Spotify.exe
792	Spotify.exe
792	Spotify.exe
4516	Spotify.exe
4516	Spotify.exe
2904	Spotify.exe
2904	Spotify.exe
2104	Spotify.exe
2104	Spotify.exe
2104	Spotify.exe
2104	Spotify.exe
2104	Spotify.exe
2104	Spotify.exe
2356	Spotify.exe
2356	Spotify.exe
2812	Spotify.exe
2812	Spotify.exe
1692	Spotify.exe
1692	Spotify.exe
4968	Spotify.exe
4968	Spotify.exe
4752	Spotify.exe
4752	Spotify.exe
4752	Spotify.exe
3916	Spotify.exe
3916	Spotify.exe
3048	Spotify.exe
3048	Spotify.exe
4828	Spotify.exe
4828	Spotify.exe
4704	Spotify.exe
4704	Spotify.exe
1568	Spotify.exe
1568	Spotify.exe
2184	Spotify.exe
2184	Spotify.exe
4744	Spotify.exe
4744	Spotify.exe
3604	Spotify.exe
3604	Spotify.exe
1380	Spotify.exe
1380	Spotify.exe
4532	Spotify.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Spotify.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Spotify.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Spotify.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Spotify.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-cu.hyb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1933277404\_platform_specific\win_x64\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\TC	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\NP	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_81013971\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\CI	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1933277404\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\ER	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\AT	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-uk.hyb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-mn-cyrl.hyb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\XK	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\HK	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_937420784\optimization-hints.pb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1931009265\sets.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-es.hyb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\LT	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\IE	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\HU	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\GY	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1479460412\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_937420784\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1780295705\surnames.txt	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-und-ethi.hyb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-nb.hyb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-de-ch-1901.hyb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\PH	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\LB	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\GM	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\YE	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\SM	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\RU	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\BO	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_720780148\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_937420784\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1357050636\download_file_types.pb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\SD	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\PA	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\NG	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\GG	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\CR	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\CM	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-it.hyb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\SS	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\NZ	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-or.hyb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\SC	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\ME	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\CN	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_660972209\crs.pb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-de-1996.hyb	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\UA	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\NA	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\CF	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\BI	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\FO	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\BD	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1933277404\LICENSE	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\PR	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\PE	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\NU	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\MU	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1865094886\KE	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2412_517485511\_metadata\verified_contents.json	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpotifySetup (1).exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Spotify.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Spotify.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 21 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133758259353170427"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Spotify.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\spotify	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\spotify\shell\open	Spotify.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1640	Spotify.exe
1640	Spotify.exe
2412	Spotify.exe
2412	Spotify.exe
4752	Spotify.exe
4752	Spotify.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	Spotify downloader.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	1640	Spotify.exe
Token: SeCreatePagefilePrivilege	1640	Spotify.exe
Token: SeShutdownPrivilege	2412	Spotify.exe
Token: SeCreatePagefilePrivilege	2412	Spotify.exe
Token: SeShutdownPrivilege	2412	Spotify.exe
Token: SeCreatePagefilePrivilege	2412	Spotify.exe
Token: SeShutdownPrivilege	2412	Spotify.exe
Token: SeCreatePagefilePrivilege	2412	Spotify.exe
Token: SeShutdownPrivilege	2412	Spotify.exe
Token: SeCreatePagefilePrivilege	2412	Spotify.exe
Token: SeShutdownPrivilege	2412	Spotify.exe
Token: SeCreatePagefilePrivilege	2412	Spotify.exe
Token: SeShutdownPrivilege	2412	Spotify.exe
Token: SeCreatePagefilePrivilege	2412	Spotify.exe
Token: SeShutdownPrivilege	2412	Spotify.exe
Token: SeCreatePagefilePrivilege	2412	Spotify.exe
Token: SeShutdownPrivilege	2412	Spotify.exe
Token: SeCreatePagefilePrivilege	2412	Spotify.exe
Token: SeShutdownPrivilege	2412	Spotify.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1640	Spotify.exe
1640	Spotify.exe
1640	Spotify.exe
1640	Spotify.exe
1640	Spotify.exe
1640	Spotify.exe
2412	Spotify.exe
2412	Spotify.exe
2412	Spotify.exe
2412	Spotify.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1640	Spotify.exe
1640	Spotify.exe
1640	Spotify.exe
1640	Spotify.exe
1640	Spotify.exe
2412	Spotify.exe
2412	Spotify.exe
2412	Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1188	1128	Spotify downloader.exe	84
PID 1128 wrote to memory of 1188	1128	Spotify downloader.exe	84
PID 1128 wrote to memory of 1188	1128	Spotify downloader.exe	84
PID 1128 wrote to memory of 2688	1128	Spotify downloader.exe	85
PID 1128 wrote to memory of 2688	1128	Spotify downloader.exe	85
PID 1188 wrote to memory of 3240	1188	SpotifySetup (1).exe	95
PID 1188 wrote to memory of 3240	1188	SpotifySetup (1).exe	95
PID 3240 wrote to memory of 1640	3240	SpWebInst0.exe	101
PID 3240 wrote to memory of 1640	3240	SpWebInst0.exe	101
PID 1640 wrote to memory of 2688	1640	Spotify.exe	102
PID 1640 wrote to memory of 2688	1640	Spotify.exe	102
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 2524	1640	Spotify.exe	104
PID 1640 wrote to memory of 1368	1640	Spotify.exe	105
PID 1640 wrote to memory of 1368	1640	Spotify.exe	105
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106
PID 1640 wrote to memory of 4736	1640	Spotify.exe	106

C:\Users\Admin\AppData\Local\Temp\Spotify downloader.exe
"C:\Users\Admin\AppData\Local\Temp\Spotify downloader.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Roaming\SpotifySetup (1).exe
  "C:\Users\Admin\AppData\Roaming\SpotifySetup (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
    SpWebInst0.exe /webinstall
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      Spotify.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks system information in the registry
      Enumerates system info in registry
      Modifies Internet Explorer settings
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.49.439 --initial-client-data=0x3b0,0x3b4,0x3b8,0x3ac,0x3bc,0x7fff8b712eb8,0x7fff8b712ec4,0x7fff8b712ed0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2688
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2116,i,4758412204492592034,17814147781690174054,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=2120 --mojo-platform-channel-handle=2112 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2524
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=2056,i,4758412204492592034,17814147781690174054,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=2320 --mojo-platform-channel-handle=2196 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1368
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=2496,i,4758412204492592034,17814147781690174054,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=1924 --mojo-platform-channel-handle=2160 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4736
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4844,i,4758412204492592034,17814147781690174054,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=4888 --mojo-platform-channel-handle=4884 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:600
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=6036,i,4758412204492592034,17814147781690174054,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6052 --mojo-platform-channel-handle=6048 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2812
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=3952,i,4758412204492592034,17814147781690174054,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6056 --mojo-platform-channel-handle=5496 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1916
- C:\Users\Admin\AppData\Roaming\Spotify downloader.exe
  "C:\Users\Admin\AppData\Roaming\Spotify downloader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:416

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2412
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.49.439 --initial-client-data=0x3c8,0x3cc,0x3d0,0x3c4,0x3d4,0x7fff8b712eb8,0x7fff8b712ec4,0x7fff8b712ed0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:792
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2292,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=2296 --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2104
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=2072,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=2444 --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2904
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=2476,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=2500 --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4516
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --string-annotations=is-enterprise-managed=no --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4716,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=4748 --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2356
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=5248,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=5268 --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2812
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=3936,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=3908 --mojo-platform-channel-handle=3932 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1692
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=6012,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6040 --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4968
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations=is-enterprise-managed=no --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5880,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=5332 --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=6040,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6016 --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3916
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=4684,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6052 --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3048
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=6120,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6060 --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4828
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=6032,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=5332 --mojo-platform-channel-handle=1184 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4704
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=5896,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=5940 --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1568
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=5820,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=4876 --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2184
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=6112,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=724 --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4744
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=4876,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6132 --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3604
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=5316,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6020 --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1380
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=6044,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6116 --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4532
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=3924,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6052 --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=5980,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6088 --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=5968,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=5988 --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=4884,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=6088 --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=5904,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=1188 --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/129.0.6668.90 Spotify/1.2.49.439" --field-trial-handle=6088,i,10289493370986752678,3641457623619725441,262144 --disable-features=BackForwardCache,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr --variations-seed-version --enable-logging=handle --log-file=3908 --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1179182220\manifest.json

Filesize
109B

MD5
4a1506f39aecad866a229fe927f2c2f7

SHA1
3f220533e12f0d8b5f0da20af857a156626ee28b

SHA256
ce1bbba96b8b7ce09bd98b07e0f0d3e4db05c0a9f2477a5cafbf7fb8383b4616

SHA512
a118937b238272e0070227962a17260711a96f7333cdaf1497a9fd0bc50b8fd511c47bc3a75b2090fcce4565ddd08f307e43f95ea7216a1d694f2e6211a3519c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1357050636\manifest.json

Filesize
76B

MD5
c08a4e8fe2334119d49ca6967c23850f

SHA1
13c566b819d8e087246c80919e938ef2828b5dc4

SHA256
5b01512276c45ecc43d4bfa9a912bdaf7afc26150881f2a0119972bffdbd8ab0

SHA512
506f9f4fa4baaa4096ce10007eb09cfa95c9188082053b9ff7f2dec65164ff57506b6a8fea28d58783700f257c982aef037afc33f62da8da281e67636430dc23

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1441798807\manifest.json

Filesize
80B

MD5
077da41a01dde0173ebbf70d3b7210e2

SHA1
4b3c3deeb9522ca4ef4e42efcf63b2674f6a5c07

SHA256
23bed5c8ebea0c376483374bad7baf633a7e52f3e0a609371c518e06e645bda0

SHA512
2822d02e2b3c6306e6d71fa62e7f472b4c3cdf0cbe499b70ac60a0a50e547ed47c394d7de88bbef2e6015920442b9d30cbc0d6869d154e02ec251712f918deec

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1479460412\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1479460412\manifest.json

Filesize
95B

MD5
7de0b6f90ce79c54f35b1ff11801a5cf

SHA1
072bec07cb76e8ab75f0de8df9961d95f6f3e367

SHA256
6916d9b43f04eae2fb5f215ae362793ce67d1a503f53be134de4486795cacda2

SHA512
4d3e837cf26f7bb5f61b8018d74e843bb3af96d1132489948abe9cca150826f639cd3d004e9c757a1965551c848652c28773ad65344359bc6a8fd5bfdb5a7709

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-as.hyb

Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-hi.hyb

Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\hyph-nb.hyb

Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1709549131\manifest.json

Filesize
82B

MD5
2617c38bed67a4190fc499142b6f2867

SHA1
a37f0251cd6be0a6983d9a04193b773f86d31da1

SHA256
d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665

SHA512
b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1767830372\manifest.fingerprint

Filesize
66B

MD5
705490f61f6a336558c76bab91b5f069

SHA1
78d47d2a733d17c48e24ec98e51876fb7c4b65d3

SHA256
b558862701075fd6b11368acff3b9b73282449910ac31ca3176f9610167ecfee

SHA512
0d6a77f73e444ff87e175c45e5f5e3f3177978403889a9552ff11f0ecb6e696fc3fd00493c232a63702e0d5bbbc57fc81ee34853e98ae8b2239623defaf9e57b

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1767830372\manifest.json

Filesize
72B

MD5
36604cab9dea08d661f28dada9c2c5b4

SHA1
a9a41ce65bd7bba5d5dbd35009664f5d251b74bd

SHA256
547b8ead735705e015613645b8c8cfaae180616ba7003e96dd1e3c819e48eebc

SHA512
d48747c393be118e3877259c602efca92ed9b663c3180d7c05ccd7cb7020f5378c7896d2fee512d07c40035191a3da8c3393242a8284602e795e5b14d6d57da8

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1780295705\manifest.json

Filesize
69B

MD5
fb195043cfc35ce711b45934e387267b

SHA1
6f1aaafee57a3da2687e9fc8defe2dbc7cba0e07

SHA256
aeb364b60303212808fac02eb490ee5b054ae843ce084376e5981ef8767e5198

SHA512
bd7fee1d6f8e51137c849d76ff53f3b501d60ddce83cce18f3a217703d3d8b1a1cc7696b656c666d4f6de62a17ea2407c857137d12e0b6ac7bcdde4b3c8ff86b

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1898123667\manifest.json

Filesize
300B

MD5
01f3de10093b3b262105724e85817fa6

SHA1
97dee66ece41b53a27cbd4579f44c204e35d19d6

SHA256
be1b2d4b5880584961c46ec8ed276b6ee43ea595da56720268e05bd3d5c95340

SHA512
9646b13e23c4214bcc45715fbc60eb9afb29f934d5d33b3471ee89a6f399a68d83b5bdff14748f73ce6a7c2c9fdce782a4ce849f855a900514636b529e9b400f

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1931009265\manifest.json

Filesize
85B

MD5
084e339c0c9fe898102815eac9a7cdea

SHA1
6abf7eaaa407d2eab8706361e5a2e5f776d6c644

SHA256
52cd62f4ac1f9e7d7c4944ee111f84a42337d16d5de7be296e945146d6d7dc15

SHA512
0b67a89f3ebff6fec3796f481ec2afbac233cf64fdc618ec6ba1c12ae125f28b27ee09e8cd0fadb8f6c8785c83929ea6f751e0ddf592dd072ab2cf439bd28534

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_1933277404\manifest.json

Filesize
1001B

MD5
2ff237adbc218a4934a8b361bcd3428e

SHA1
efad279269d9372dcf9c65b8527792e2e9e6ca7d

SHA256
25a702dd5389cc7b077c6b4e06c1fad9bdea74a9c37453388986d093c277d827

SHA512
bafd91699019ab756adf13633b825d9d9bae374ca146e8c05abc70c931d491d421268a6e6549a8d284782898bc6eb99e3017fbe3a98e09cd3dfecad19f95e542

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_258963796\manifest.json

Filesize
108B

MD5
b0f13b6a0764a7fe3958415bddd4ad30

SHA1
8d49df07676187cea48db8e60d483716de3fa8b4

SHA256
1a1c2c112ddf1694ef40c372f03fd9c3b29ac36bdeb21c6c86d1233821083f32

SHA512
530b813df3c87bd4eaa0b04deed9f91e3a01aad017b509c934b54f9aa17cba9466da04713651ee3c7ac6269dbf6275855d8ce96502129af639396fa37a419351

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_517485511\manifest.json

Filesize
76B

MD5
4aaa0ed8099ecc1da778a9bc39393808

SHA1
0e4a733a5af337f101cfa6bea5ebc153380f7b05

SHA256
20b91160e2611d3159ad82857323febc906457756678ab73f305c3a1e399d18d

SHA512
dfa942c35e1e5f62dd8840c97693cdbfd6d71a1fd2f42e26cb75b98bb6a1818395ecdf552d46f07dff1e9c74f1493a39e05b14e3409963eff1ada88897152879

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_660972209\manifest.json

Filesize
73B

MD5
5a4e52a06859890d9d630d48b364d7ee

SHA1
7c7125c02aeb83e6f327345b665fa8651e17ee23

SHA256
7ec5906e1cd1aeb6a36d55b3bb633ed1a5b2d5fe46547a1609279cb046092f09

SHA512
a5c39be4547a1937ba2019f95a2c251afb70384568ae5308b85af943370cd0c72eaf0138921aefd4dd988e3c18773e1461a5d7ab17ccc64c43321a70e3f83a9d

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_720780148\manifest.json

Filesize
114B

MD5
3ee731d0e5bfb74cacb3d9e2dfdc7768

SHA1
ee15cb60213bb402fd90308f0f67d7b6160c9751

SHA256
5dbf79f09d999ea982d90df45eb444ebf66a0c700e51d4c9856afbe7326e9d69

SHA512
f38e3fedd392f9b273565cbe321a56051edaf48db75a0ebb539d57e8d1238d4bac41e973f037395f9c5d4a189df5e68726ed2c000134fc36bb7e7295c9a779c1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_81013971\manifest.json

Filesize
232B

MD5
ee8bf8833efd1c1cdbe87956dbf751eb

SHA1
cbf347cb9754100adf3a4fca18b52bc34341fda8

SHA256
1a2dfbb6ca484e2c57753b70d0e6f37b424366123ecb572aecc2498a5e823039

SHA512
745b16bbd053e0f598b9e4fc1c4f38a230849980ced8468ca509e0f671798de7035bc4e03b98cab27a748944885ec78a786db725d8e41d9525b29392b2e4a460

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_884641881\manifest.json

Filesize
111B

MD5
225c08f039684dfb54aac162dd9d5b9e

SHA1
426bd1044bfcd5e1a10b58ed1f217a6b33b2e9c3

SHA256
98306b21c0aaf9546301f4ab7fed785dc369c67e2fd2ad4d62fc63f072a51e3c

SHA512
d6ff6cea0c08d13a642996a110432792048d21160c04543fbcacc60abcde362318e13a42fcd7520bc7673e98544a68a3eb6cc4338f4f4d8e90e0dfd5c40b77b7

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2412_937420784\manifest.json

Filesize
108B

MD5
3bfff137cf06f4bf2c6de03dc24947e2

SHA1
25971600ec83c3fd118ef8c42ec7682f93d11fa4

SHA256
ad1b51fb7cbaca53d730c3cb8daf7e5a984546fc022d8a4d16bbfd709a82548a

SHA512
e6d4b4c5accc74e1aa8a02fc2be14c971b2d7d480c6ba9fe1f416cb56b2c83190f661d363e5bc63daa04ef2d793563dce3e60192554e33d414ccd1daeea3f38b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Spotify downloader.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Spotify\CertificateRevocation\9290\crl-set

Filesize
657KB

MD5
a682218085631e4f389f81253003b3a8

SHA1
0585d898b288911be3c9ecccf0efb54625f608b9

SHA256
626c6bb0bb84be702fcc2b877ef0d7676c6e8022cda30a33d7bb40d4910929ff

SHA512
9969272c9211d720178b17cf535bf81ed75522b154967e709ea22bba3bc1db2249bb727e0eb1fa37804b61c30832e90666faba90aab9e8864ef2893b492d792d

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Crowd Deny\2023.11.29.1201\Preload Data

Filesize
12KB

MD5
aa3ef996bce08a9c34fe513d078d1ee3

SHA1
21688d164d442d37fd5471e13b41b1d216f88d37

SHA256
09d2155be71880356a993fabacc2ce01f4fbab99497ec157b53a094b8927c039

SHA512
285c85ca55fa54a1a12c47909b8575e8388570a76f238dc75aedece12e58dc0a3fe15edeffc41af14bb7944a0682de76f0ee0d6502d15973f8d9b1c5b2f828bd

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\5818584c-0679-49bc-b498-04ec0e75ff29.tmp

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
2b2c9f7fd7847924c179053be013e0d6

SHA1
116de8f362e0e496ea0d943f4fd1f0b0dbca7240

SHA256
a61d0ad4f0663e1df2f96f5a5e050a4e7b1e5af7bdf070f0a82a9d44cbc3822e

SHA512
620869e6f29de1dd7253d23be004e28a0fa8eb089fd0c473f5deaf4eec59e2fae152fe4b7173775ff78f6d4a23a2b1bbd53897b53e96ac3459ac41631e26e96e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
a3fbc1292189cd9d77f3f073a1a9f728

SHA1
f9c96b9e75fbf12fc1c972e34767f9df42c8e326

SHA256
5b086f3fbd7f06d35357e83e23978fe18501762cb5d692229ea06017099c2734

SHA512
fc056ad4d88a9c11873feeb7550f93367a9e872e9cd550fe374572e80b069cd38e246ad155135592e8ff6d34b4122d96e4d2d21f3c155876e30fba4d0cd6b3a8

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
d53b25b69a776a8e6ca763528acd8fbc

SHA1
abf005b7e85e0743a408eaeb06a5306760d3249e

SHA256
a5bd51a36f4aeeedcc3dda15c9280fde30ec0240b866a0edf48b914438686e28

SHA512
a40d069b5088411c30f48e094c1b294b2a4035f50622826cb88cf227e8f30e9410713f6010981974ca0dbe52514ed004c5e33c2ae5b584db4f13a68d04702fe8

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
ef06b98c2164a53a6dbcbbb4c799ba4f

SHA1
5f7fb53357e6ad531ccc64c29f1c5271b648045b

SHA256
f6c61500dc968efef2f7c1ec9fc4897ea73f30e53a414201bce6ebd73f203f40

SHA512
467327b888f8e2b5af3bec27e95023205aa0e11201fdd4eb302240454a0548e38d52c74103864d019f54069e563972e7110d004941df51c5d6d8b15b7a5e4bc7

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
476118b7f4fd1a3206856f31b7fa5a08

SHA1
47016962f1c95e70bb050024ce93408477b4e330

SHA256
30177fe0dbcf43493cd37bf3c3b64362b79d5bd10734bdeb40c94b894496f8b4

SHA512
770972dd7b952773c25de1f706cc346cb8061bbf354a83f58edddaecd99f17ce83c0ed71667588182eea4ad4e71e22507192b70beae6c8fcfd31d9874699441d

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
a1c58099e4a79711b67e3a09f1e4eb18

SHA1
7f5357a7468b86570645e7391c15cb1383a53076

SHA256
f3ab7b79b271185470c20d0e4e3e1eace3547571ab7c7f83886ffa7d4181e6c8

SHA512
763658218f36c8052f03a437d5277553b66f7df79d339bccbc7bfef7a4ac94b5940c6a72573066e56a4ac7234d60d7a71292a5948f824783ae9305f09137ee16

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
da3348241f479066b18186b8b10f8e4f

SHA1
8b07595fd52cb5a378aaf9d2ed51f95380716259

SHA256
1cc148f3b1b7ea4b8b9fefb6d8666883949814f6af14d4fc83a6d12040e7c635

SHA512
f0e0991d5899d749df895141b3ac57fc4c351214e7d4851ca35c478f4220c2f6af5a19cf0dc9b3f15d8c2ad386a1cce53dc4de55c4d3224ea09380f6806d6d6d

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
ac2613ec9e639e21f0c4028aaaaf3cb6

SHA1
d719a3fe4bdbf4d3b3066a5b760c069a4163f380

SHA256
776f6f0708f396ceef26855bb83f4c974e53b9df20c0c9f0017fbd0e4ec6a587

SHA512
a0217d226f4b15f5fe8fadd049e8da2cd9f00de15ac5314f5bbffb35a2aa08220546955069535a2224b73e9cf56a7856d71c7d702d1a3ce1cc47a7bce3ceeca3

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
5b66089ae66f592e10df76f14ec18b82

SHA1
d71210f67d2bb3133630268fb8af66be24d03733

SHA256
e960ce131c8c7045f1b51c0a3412ebf173588b306705d925cf39b0fcba39f64b

SHA512
efb80f265c94db1186bdc716a899b094927ef3df8efb4591e45a52202fda03f446664b7ae86657d34bba665ffda96766571f70011312a54dfd3e69e1273a855f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
578ad92768cd2b56910f9097aa2093bf

SHA1
4c4e453c9fe7a093a00d5b85edea53b2f7aebf42

SHA256
b85fb9306bc79bfed4716a04650fa38bcb3d0588d28858f5087c421121f6ebfd

SHA512
ab0e2a74cf8381e8c45979c2b62c1e1cf965e9c516ef5162c85e3cb1218c4b5a316efe82b648f53fff2509ce63c1a91357658a3405fde8092b487c1d47423b75

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
11f49cca9de572ad63ec8afe67bd6f26

SHA1
15dad22739468d4c8c1a59557bf4e32ac33db71b

SHA256
ea1669683fc47f01a6c37541db33bf14de3a74dbf9d5150d795278b908483f22

SHA512
d56ad53ac99377518863a2fdd58d6cea7d40a03b2ee172506cfc5f3868f1f5dd6272f5e18275898540cb863b4891da41831ef03dddeeaa0653ccba1219fa423f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
43fd485702b0dae39e83548149ffffa0

SHA1
b88743593ca0691d2cfb05995f541c0d06a3adb4

SHA256
23507ea02db6db06d5f31f511819d9a92e06b16a0067c0aa858356a4ea6335c7

SHA512
d9377db2234c1824bc39c897e291b5c1eb502f78a981861d425a3d420f3ee7c99bdad57d3fc607cee1ce5bab5db9c9822e7cc404ee0cf17e042c455b3db41f59

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
c32a38657958d44794f9602fa79e9a48

SHA1
d2371ab080e2f8f42dabedc50d033b7777c0853e

SHA256
1d8f9a971b926301e148577e6d57a13362399b82ed7ce1bf4d73cc3f846baad1

SHA512
bd5c848fa2b5b8786c1c37d4df1716582db8fcd6e2ed2912ca64f91053ae0fb76d171a2fc462a62bc60a1ef4654deb89019933318413072a9b7585b47c3556a2

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
405300abdb01dfc7642dd158dd5afc63

SHA1
95f625c6e8038e8a1f368fe9d90914c2c7347477

SHA256
2b92745c93b51f2b8156e0cb3d75c87448db6c9133e115dcba76c35c74f317cc

SHA512
ae5242a503d088c6ce4d78fcee36c9bc6d2421d20f46adbc668a2e14caa25328b97b98f652beca81cc580e5ed38ee7751c6c4b9b0901ac783e24d7500193f3c3

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State

Filesize
1KB

MD5
2b850af596101cac98135db753f12e4c

SHA1
36a3afe0ec703e39bce4e7080346a6926ae43e8f

SHA256
b0670273c8499223c224a8fa5f6b8725761932343f7ee34fa84a9eb887d06ab4

SHA512
018ba43046e19e027de90337ad174e3a40cb31b64a53e742e0e23f79cfe2b4ef27f42992989ad2416626a4e34448dfcc1eb2f591cad8db4c26117a310d986ac8

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State~RFe58a5ff.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
9347e27dfd94751e85b03d4b050fbe04

SHA1
d1ebe9d704a7af383b9657c5a1f7e87fa14df84f

SHA256
3fec1d7e2fc4740d452f816a6d68b3b8d9c52af89b4ed417d87010cdc52ecf8e

SHA512
df6b048aaf9ec6a72ec4eef84a537f9a7cb4b5a563e96dfcd4691a850739757d9083a37638e8b640037bf96e68d94a9f01d268d55e17c3469d158c24c9571ab1

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
e933dce45b7beb8b6c4fac45fcbc9bc4

SHA1
42e31c00057ab9cde1c6b46c3870a7a9e5771179

SHA256
fa4d1f2b55eb2499e2e29df45166982df32e8ac2891dd85d90a6a6cd98366c80

SHA512
bb0fc29a95497fce82c5c84956aa10d6e06d282e5d966d0ef7456504faab19fe03c280cbbc405035a809ba12a511fa7b8f9cb17ccd0e5141f781937c4f220dc7

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
25d1aa73ada1dd2a0f6c68a18cdb6e7b

SHA1
912b6724448664c1662e65b52ef361e01e3aee3f

SHA256
bbb54c4705b90d899ded7f7d42f6924e4e53fbf7966302ba0ac40c1a216cc4f4

SHA512
fcf69d975986bd3191abfc9bf4c268a559149c1ad83a311624c096d421d1daade44cca8d075847556d94df907cac8ea3c87fa81e0187f042e868bf14764c3bfa

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
0313c203a74ef007dfa40141863c7ffc

SHA1
513685573c18c7343144df64bdfc641b94bade9a

SHA256
95fcbd1d9edace6737e1cc43a7fde8f04470b34a14e1653bcec61b76b83405fb

SHA512
71cd0b2ddadab452ddb1885cdc21116df4df9c48aa46d02aac3faf3423e543f51be34b1b9d787922c4e6c3c63b1c4cb68a15c59ab2855ef4f6cfa92558ab4a55

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
584452595a539ab61b2c55c496b9e7f6

SHA1
d6bd64b437e544d91d88450c24292d596c4db5ab

SHA256
79256589cc8e6b79ba5101fb4ed145b1b94bed6b79cc1abff626397493b90e76

SHA512
5d9e180fff2f97caf4695164c540683b07504a1d8aef07cf8297f3bce98e32be2593c5fea141c7864c361901a47e12899df3689a437fc4254d8bad43087f120c

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
af74aafdd12d0bf80abb6da2f91cb1c1

SHA1
0d7df292cf9986c6d799c2b2ea03cf4b98fe6500

SHA256
b7b5d74ec3c41fcb636945986400335aef5ef79ecf037aa6cd57a80765610241

SHA512
84dc53f6df36a2d5a83dc9d1f778cafce94e7539c93b59364965f927a25359f4d4fe80d095fc2de34e66c19cd0fbfd02203ff6056f0c78e6d45b849722799e4b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
e1c5b218d077a595e31cc7dfa60cbbc4

SHA1
084d788828acf7075edf61cc945e3f863296a9bc

SHA256
1f1bbe481dc50d9c45ce78d9fbb6bf33d63d91f73ff00120bf8ba7fc8720bbcf

SHA512
6a4b6968f93624903f8d9a347ffd836bd915cdf4652423d36ec7d1860557a17e0229ffa3a343d348f1c718d7d47d3ef42a4d530cc2a3cec73f5950264e21bcb9

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
3c2ec1e4cd901c0bab5dd216ad6c0555

SHA1
2bf1afb69f74b7d2aeaf3b521f4564a5ce2d2f39

SHA256
0193391b08283eaf29aaa5d1671d50d96d8a9d69cd555084d803eb146ef65403

SHA512
53087e5a98f767de96a7310047c8e9591b9ce174c6783e3c18713cebe1164fb20a9cadb7c15eb939ed6bd99000549bd1c120a1333c773711f5c60219f6f9c0fb

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
ed71d457955dea7a7e6b2a3c2fd896ef

SHA1
8fd79e965e0b3592bfc23bec8b98ce618c2855e5

SHA256
453e70f7bee09c3b6b8e1eab37a3035cbe91a8814e3ec4fad4d4882ee9228ad2

SHA512
84fa100ca8eac418acffb678f9e62e4ee6a0922aafb49abff26f405dadc485f092662450708feb8cf3edbfc6b62b18ff6120bfe47737918792acd30bff5ab4d8

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
0da5cd662ef5848018b2a37b30ba66e9

SHA1
2b5eec53aa36894321c943c39ca31a46f9a257e7

SHA256
c19b902da78935413ce32b0711675acece47333503fffa5f3d7f9e56e5a724c9

SHA512
977423ad476c497e9afa48820868f4aa8771aba5823750c0ce1c9601856bd8151f1ecb278da25e81b94746e55442011ad2d7a301df14d1d54bb6dedf20de2466

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
859B

MD5
050ad6a1d272555a39f2e7567e903d8f

SHA1
d831eabf864269d90b336856253aaab9ebc5770f

SHA256
ea065eea2b7ba8f8136722dc951617dcbc02f61d88fdd883f33b7df32a12b85d

SHA512
eac633d4c9d81ebfb96fe2b8096ec5549ed25d661411dfd0dee55c0e550cadc50f92576273abec9cb3b9a5c76f820f9103a145c6b0d6b2837a843db7b0269727

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity

Filesize
855B

MD5
cdb05f962f828fe346a8e556ee28e8a2

SHA1
546d1e6838faac908a0773748f4614ff9f108bc4

SHA256
4155a4e8a47c35af4c7973504019354c59fe182e337fc6712ec0fb4f9fd8273c

SHA512
087b15c21b31cb25675bdbbdc07bcae29819489194709818f1e4268854fd8dc094aa6a97e2207de35e0a416b88c61b05b9feeb00556750acbbb14d728497a7c1

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Preferences

Filesize
8KB

MD5
95b635f934966780f9ea3e023438722e

SHA1
40ac94626836157acbd142aa42ee56b462467ba9

SHA256
d6e23ddeb6cca585157bfdc958fc8c866e9497d4bdacb85276fad34f7848e0d4

SHA512
145ced9f30dd48cdf70869a06731f628810b583c952599dc706ba5a5205bdd1a28a2cab0230315e2e22b48348cccd90ace4bd61649bbf9af8ec146c3a119712a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Preferences

Filesize
8KB

MD5
2516ce6dadc301e39644ed3d5c229a6c

SHA1
9ba8738385a3f1b407afe7d0774b66f7562cdf00

SHA256
9dde190972ac3d9476b61b8bbb5d76e98eaebf39ab0c730b5e7566776d18c731

SHA512
f40e446ff3bd6e25545a896f351b5f96ed3489a211e2b6066944710afbbea1161f2925f69a779a0bc44dfbec3b47210c382ee52448ac46b2732e25e968a91504

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Preferences

Filesize
8KB

MD5
4f822258756514d8a238063bd97eb29e

SHA1
506e9e6ec45eb6a083cadc8d8c921fc405efada6

SHA256
24ab2751ebecd13f29f77cafbbc0e627023bf51b1bdb6bfdadb9e90680413f95

SHA512
fcf6cb077d5c3e03d5f5cfe4603962562b0ec3ffd01dbbfbfc666288972fc3732dcb2b010b9c83f7b29d93ad5874b6b07795e4bb55c4f942f667a0c2cf897954

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Preferences

Filesize
8KB

MD5
84f41b95215e23e7731ee717eb4887f1

SHA1
c646348bdbc30e2d8aa01f933a9b8817206bf078

SHA256
558189311b668519d57f3dd6a0bd594902e0153a1b5ecba175c7e5e1f74e3780

SHA512
c8ccd3f77f65a74bf90057d39de28d8662a8c2a2fbdf70a8575f922bc57d044867773d3e6391345c09c3f8e83c891a78176af5285936f8034c8605af1c8fb0f3

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Preferences

Filesize
8KB

MD5
9f85098bd974431b51c6e911d769e9b1

SHA1
d4d7a08542281e74ad16c7d90280aa7da073a17a

SHA256
7966e360d2c8f3caf2aa3432338418297de51eb38c9099bd2a718420f44a5cae

SHA512
b0dfc8c13e87d7aa75021428e612c77d445b3c6c36da68fafb402a4fe3ce38f50fb04b98fea488aa99fa881fab301337a9dfacdd4d1967a79439bef9dc6ff0dc

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe58680c.TMP

Filesize
7KB

MD5
3ed0855f97af67634e5788a0804cbecd

SHA1
81bc63f8e124d24166f1193b55755da7ed1c260d

SHA256
6d6269223c63e5443aac82707e4758101c71ae27c4c2c61c17e4176379a3d5bc

SHA512
a4dde14d05ac4a8c9c80bb3b485734317df8f02fd1059d7e3d08972da970929d79fe4ce2059b3a2702a150fb8a92f4f99fc63422cefe7e46c870a63ae2a09fb4

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\FileTypePolicies\67\download_file_types.pb

Filesize
7KB

MD5
d28b6246cba1d78930d98b7b943d4fc0

SHA1
4936ebc7dbe0c2875046cac3a4dcaa35a7434740

SHA256
239557f40c6f3a18673d220534b1a34289021142dc9ba0d438a3a678333a0ec6

SHA512
b8dbebe85e6d720c36dbdae9395fb633fb7028fecc5292498ac89276ae87bd6de36288fbf858f3476e18033a430f503acf6280596449dd0478b6ab7139f3cea6

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
5KB

MD5
89e4da0c61827f7bdf6aff2d423b27e7

SHA1
99d976e579bbda7c66cebe711890788ac58c8f73

SHA256
da16517a252d1ef008b8ffea47147f9f664cf6bbde611bced7bcdee6b1bafe6a

SHA512
1229dc2d7e8916b3a3b66194c42fc52361db68503b36e72ef97ff649bc0149d3cbe55ce9c0d9a4995b626c7d6d51d16ae635925c8d3202415a013571090dded8

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
5KB

MD5
8133da637dbdef5863fec1add66bb375

SHA1
673b4fad4d662431209e1c2234840c5467c45d05

SHA256
17746f8a68b08db767fb6e8e2a6b67b8ca7d3bfebb71df8c7500bf6f1991914c

SHA512
57990a953f9ff0038bb3e436fdcc9de64befbd44887a508eb83b4a253205b2a18591f92f1d86ca41d6b99268c1ff00edd854e4d1eac2102fd464a20abdab6f88

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
5KB

MD5
433854cea231915246d1b5460ed2be25

SHA1
d12b8954276961f6218cc5c5af5697939014705a

SHA256
f57e4483bd526c39076ec85fcec705a15ec9174244882d3a6623e3dcfbda0566

SHA512
8b33d36bd4b3b7b8d4bfef0fc9a9bbb9eddf396ed6914b3229b8428c9423b8ce722ed2eb85ab0fdc66126931455d843f936e292c2bad56660b49d2fbea366b6a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
1KB

MD5
c15bc52a09ce5376c15333b221fbae2e

SHA1
76638951f0a69d70c75cf7453796670d30e0ce93

SHA256
0e0b7f1fd9ae7fc85a418e2bf0ebd600cbac41d25f34f55502342808cbf93d4c

SHA512
a381887a834769313e0ec0e1b852af76f415e416c8540329c5f58a7a2e36f7918bd66d5f3013afa2e4c6141e22a4ea7bbd16332cfb6d8dbbab1e108e7dd994c9

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
25KB

MD5
7d37a70d8b599c0e5a7769f29abef8ab

SHA1
a8d406f6619228575668a56998f18f8d0370545d

SHA256
0e21742bf024dfc5f9a9af69cc82c18a881b1d047d6d4b7c7405fa35d9f807af

SHA512
fe53d9d739a529111625784897f7db905d3c9a2c51a03313860da9a97b49556e348c63c0fdc3f593214cf86964265575ea0af22ff141185d709b09619e29f126

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
5KB

MD5
2bf998404622fbfab100576cb0f83597

SHA1
5d486554d4daf5ae595b06ed1d1054aa935ab755

SHA256
afc7afc6b7e7eeab3c5fa8e24296c2c281be0d7bfdbf3fcc3f6a6b392601f786

SHA512
a9c9ea9e363541bb6ebfd9d94a92de81054626ebd533f3557a540201f8c090f819ae3293d5008a4bf16d70b1826e99ff9cb81586c415690af12364029f0d5020

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
2KB

MD5
024aeb7c60d632cdd4ca247224666954

SHA1
44ddc7bd4359f285e48f2f9447c99dceab8d13a3

SHA256
08093fe689f23a7684a4dae83d949df2a13ef4c621a883c421536a931122643a

SHA512
2f0e669c193503bfc6c9879fcab6b606c9dbd5648fdffed4e367778183e4a495f7f55eb0d641a9faea872a534213a92432fc77f05bd7d1ce7d5f6bd19b428e75

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
6KB

MD5
f8773a84d5da9fc15aef955646aef1bc

SHA1
9c798a3aa0c132a9a03ad9f71b4bf48fde6afe75

SHA256
92f5aa250f5de023966ebdd03020ceae31a1e025b65eb6d090637d409c72f538

SHA512
8f451cd59fd626867c4d683174010dbb283429428a37215cd5069850078626bed354c031d85efcd3edfd1efc754a0f05cd0379d5518106e47ad9216e835f565e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
5KB

MD5
1a15be9d371836b5441fbc509d98386c

SHA1
8278edd395493cdf7aed46501bf95f349f05c407

SHA256
72bb7b870464ac63adb0628c416f96c802dc45e818c78ba88fa9771fbc2cb088

SHA512
6769521097683ff64825b950a5d8dd9a46e30711cfb4475c40fb8e1b16f3913f3f5b39d98abe58607c1ccea95db585e0802c8fe13461418afdc1df7d1a34a6ab

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
25KB

MD5
c68b5871195a3cdd1c4cdb7bd290781b

SHA1
6dd16887b7c04a139512bb54ee7938e0630f0f0a

SHA256
74fc313aa48ee2996ea81bc6744e8ef7765ae28a1cc4ce12e46ce753bd6f91fd

SHA512
bc5e9cc224c6f7c53e6fec899942e105e674a0d4888636d300fc580927c0ad0c409e2f3c020979b15e0a66d568d0f97ec744de253b51b85685e53d05920ce9d3

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State

Filesize
24KB

MD5
c56a6d3efe07b5314bc3e19507af5b09

SHA1
e53f869f1d9f885feac23b1ec900dbe4da6e5c85

SHA256
01f6813a72da293138c6002a5bd2ee349aba3c95b4058cf5b2568032a5eb08ed

SHA512
4010c179e97d2f4ae829fb4e59276d1a1692a730361ccf3f5d57ee1f23873ec56f738b3dc2227f2efa4875126b737aef0e48cc962be31dd8f2b5a8e0c3efc5e8

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Local State~RFe5816fe.TMP

Filesize
951B

MD5
42d0c6fcea6d3a85085167ddea870bb8

SHA1
96057a4bfc22e943cf63bfb10abbf978891b7c94

SHA256
e1c5abfe30c48211cd532952405cb01c23f0e318a8d11973b48c2a81c6df9dce

SHA512
356e546775df1701cfa9c0f75477fbb79d6c0dbe66aab1b650bc0188d2781d34eff4fb50f9f1a37480cfcbcfffc7e66d19a5a2214bd593e60da37f6ec1b69791

Download Submit
C:\Users\Admin\AppData\Local\Spotify\MEIPreload\1.0.7.1652906823\preloaded_data.pb

Filesize
8KB

MD5
d5e4c2634eff8a9b3faf432bf406d6d1

SHA1
a691f5c9877079193c1f7dfb16dbc30bb0372ec9

SHA256
c6070a157b4e28d16fbccbd233e93846ddb070c85e1a1bc64469b7a5f1424fad

SHA512
b264e28ac8f111df01c553445aadc7bcdb3f32a38a1a19d3f9d458270dfeaf80efa7144407bd999892022af9dde9dbf8a0e19e7212720e1c6511ea9125afb166

Download Submit
C:\Users\Admin\AppData\Local\Spotify\OptimizationHints\474\optimization-hints.pb

Filesize
52KB

MD5
2f6b4af55206d991bdf470ba8b8af25b

SHA1
fd5a8137cac84e2c0df4d2d7102467de7ee483ac

SHA256
32ce2a2f9910a7114d53aa57a559959d8dcca3a37c7ed3780003359bdf882c92

SHA512
67785852ca623e55632a56c58a910f43112c4797317d90fe96dc0ed0182eeba9ff4844db4da2f60e7e154cf6799faadb8fdef090d9809fff7a8bd93f4f7fa76a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\PKIMetadata\1128\crs.pb

Filesize
141KB

MD5
57086b02f74c3fe7b79a5e2e3d852322

SHA1
6420387225ddcd5210175de4f3fdb0ab2be8ee9c

SHA256
a1b5be8d4aab349aff58ed34e1f3bc6647cf440830da0a12a8bd5a1c976c6407

SHA512
b195eb9a9129863e75be603b00b85ecfe46360910529fb38513af6940f9d17efd56f234b47963452329cd85b16bebb5a85ab5d304743e57d33bafd5b59900468

Download Submit
C:\Users\Admin\AppData\Local\Spotify\PKIMetadata\1128\kp_pinslist.pb

Filesize
11KB

MD5
af9a7f26ffa72d44d24d815f25079009

SHA1
e9acf3ad4fa036a3919cc4a15a40099f4804d06d

SHA256
7e3011a6b31595aa910cd9acb7884f2d47c18382719282991cdc81c5a19c2db3

SHA512
e36b478c05d9096a330884474a72b239f7108e8947972961ab3611ea16b0d122064efe5d48c88d349eacae099fa8e3729ed16ffd70d59dbeec2831d7c4333c5c

Download Submit
C:\Users\Admin\AppData\Local\Spotify\SSLErrorAssistant\7\ssl_error_assistant.pb

Filesize
2KB

MD5
e2f792c9e2dd86f39e8286b2ead2fc70

SHA1
8a32867614d2a23e473ed642056ded8e566687f9

SHA256
ac354a4723aaa4f06bec385ddde4a4d0983ad51456f52b31a8068ec97d5b5ea7

SHA512
6a7af0ca1efa65a89a9ca3b8df0d2e24f21d91673c60cdfeeb02d33647442b01d535497249542f40e66e0d2dd3e9f8ed1f4a201fd97138d07a2b71366737e580

Download Submit
C:\Users\Admin\AppData\Local\Spotify\SafetyTips\3049\safety_tips.pb

Filesize
161KB

MD5
9d5e630decf9d5f430a5e1d8f687dfde

SHA1
84093f27adb046d2acb7ec98711817ae8bd56fef

SHA256
369287201a628b609d7a7c8e0fde95888d542ae71280d7dafd482c25a499e3c0

SHA512
afdf44980a3d53bb17af054269c9d9425e8fe94828f4a6ade0c8fcff138f2f8278349b6403da2b05b26ef5ab59837bb95d6147560298fe62dfc1e01172571df6

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Subresource Filter\Unindexed Rules\9.52.0\Filtering Rules

Filesize
72KB

MD5
c6af15da82a8a9172fc9cafc969de4f9

SHA1
81f477e181036d551ef6f09cb875c6b280bebe00

SHA256
782009d9765c6104a1b4d1eac553834e7e399d749a082ead42bb47abb42895b5

SHA512
f541cb1703a0bd31fcb6e293acbc6e20f73b365ff8d2270a6d44780e9d5731b8d7803aecacd49d73e0da065dd1026c9fa95f9cad2bf0776ce1e2c3c9fca052c6

Download Submit
C:\Users\Admin\AppData\Local\Spotify\TpcdMetadata\2024.11.10.1\metadata.pb

Filesize
32KB

MD5
bfe99681bc4609bb9a810e46a7481d5d

SHA1
61dfcfb568bf5e85e7bfd603a6f003b7572f650d

SHA256
2c7a77b058e1db2bffee1048ac35ed01f37ce87d69f80d5e6b7f6dd5958bd6ea

SHA512
b9dddb2074582110e22d4c35694ab340daf1baf57add507292da5008863cbd1fb8e75299fb402541f0ba3d619582306553677cb1dbd537fb9fcb3b293fc275b6

Download Submit
C:\Users\Admin\AppData\Local\Spotify\TrustTokenKeyCommitments\2024.10.11.1\keys.json

Filesize
6KB

MD5
052b398cc49648660aaff778d897c6de

SHA1
d4fdd81f2ee4c8a4572affbfd1830a0c574a8715

SHA256
47ec07ddf9bbd0082b3a2dfea39491090e73a09106945982e395a9f3cb6d88ae

SHA512
ed53d0804a2ef1bc779af76aa39f5eb8ce2edc7f301f365eeaa0cf5a9ab49f2a21a24f52dd0eb07c480078ce2dd03c7fbb088082aea9b7cdd88a6482ae072037

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
9f4660a720872725ef456b79557532a3

SHA1
8f75b9e9e1ef1a60271782803b00c0ff512a072b

SHA256
c3af446a95820d1820afaac0d1fb2e2130cfee7cb52adbcc9e05b44c1992b342

SHA512
d066573d481c61a290b21a0f197c14d2b75f553bba44f571ae16d7867a8606621734b45cc74d1491d23e3e2de047e608e5487436f605efb7efdac2a0ff99f532

Download Submit
C:\Users\Admin\AppData\Local\Spotify\ZxcvbnData\3\ranked_dicts

Filesize
865KB

MD5
959460a18173908111523bbf4c39073e

SHA1
c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc

SHA256
5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0

SHA512
291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify downloader.exe

Filesize
181KB

MD5
660c78f925d6ddcca634042883bdd956

SHA1
373bb462c8b640126b597475b41d388e9b6de7be

SHA256
4bc2c3a8c206b9beaaeb56ee28cdf7dc5bf9b5b62e2e1d3b52053017742c37f9

SHA512
372841df239ec8d5fbd39e6599340d4fc3d65c12b8c6cc913d8160cc4ca9978cb086d7fd8dda810260b97b47fcdfcb17079efcb1b7bb12d237f59ec3546cd31e

Download Submit
C:\Users\Admin\AppData\Roaming\SpotifySetup (1).exe

Filesize
1010KB

MD5
b10f6fefd3e1000f950323b961108bb2

SHA1
26dfa48343464c574102607e75e9deb6d92e01c9

SHA256
56b68adbeb6085189ec52a7f8c3d70f6946505e2c778e0efbcf5a501dd7e1938

SHA512
541af6f3db8c662b81a94518b4371b19441249608d35e92c45b36b3a207969d1bd5fe0cfd7e5271c946b337e2ce1737add082804b5a59dc91ac99b4c2df0ddc5

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
3.5MB

MD5
04deb28fc52a7f7ae1a3e45c70961cb4

SHA1
c9b79891a7fd7665f82034808ea2b0ea50edec8f

SHA256
bfb18ab61700d5284e4adf42ac37593eebf9962d216241cdfe5ea3d8917c8f1c

SHA512
76abd2a3b18c2a6e3cef8a1ddcdb869b24488190b04a9946c73a5a5a5a048a07ad1e549418ea8bca2264362ea99828e4c49a1807bcf42fb542bc887fc0a0bbbc

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
34.5MB

MD5
7bad85af975fcde64345c3d9a37a4599

SHA1
cd3214fd2b6acdfe37f01d4fee1001e6d3c0de57

SHA256
36094c5e6a62adf40e23d0765f29be9b5e7cb6e0c5a85ab8c53bfb0f8f2abddf

SHA512
e26d44c958416eb95a682f2309ad7fa59e7f117241d7f1d40cd92ad794b735ecc67659e3ba4be0f0f4d150ace73fe3990e0e16a581970b07a4419f0bb0fa0c37

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
679KB

MD5
315618a9e00e46ff870d9c0de2509121

SHA1
a1401e40bc28ddbddbd6fcacb29c4aba43741e5d

SHA256
9e3bfa5ab9ed42990ad4bebc2edcfa01ce9ff694df9f09cf2fa0b2b235e94710

SHA512
8ab44c9b7e12702daf703d97346738148c950d779329983a1f2806b0fb350d77726e73a7f96f3eca1197e411116401ab6550e1ca92e89dbb5fb7a163569a1d5e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
6c5b88cb407f1e109fd5e8efc759022c

SHA1
1a51194713a44f7f6cde9eb4654b105a18106aec

SHA256
9158e9ffa46b73bd6d2f5ad7cb8c7e210b4cfd66dcd0ffcac051939c60a7c93e

SHA512
48666fa041c13b21966d4d8fbbef070c8ed09b0c81e37b127f0526b01d8e146cab452007fcc84399f34e5309ee48681083faf3fe64d2e92a088f2dc7470404a9

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.3MB

MD5
5a484bffb1f3b7724e612d2d6087ae68

SHA1
47e209557147cb1c4acdbdbeda43cc004c4ae054

SHA256
ea6c466e98fbf1856062afa9f59a1b3dbe2d41f891c0691ae1ecd4a006b994e6

SHA512
04acd3c14fa771eec9c9247549a44e47d8ef9992f7cef53efb6bbbac074d91906e456453c3c77ffc179aa7b3a33e1284643406066d4aba1bfe09f41649fbed51

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
577B

MD5
d986a0ce2e2bfcd99cff8e85cf117f90

SHA1
c5fd9516b09dbe7ad2486ed6c11f983bae68ac76

SHA256
384dc4f65c8ebe6fc1c8c516fb80351a3efe90a902c2966db16ab2748bfe435e

SHA512
c9c1e6dc1110a9fc97b0e60c385b271c785b79ba67ced87fecd8d2f5da9e7e021c68608d66c6fc78e96cf39ba31a2b589afae6292448c77e2e84228d4fb1b490

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
4.7MB

MD5
1ca14592a99cf6b6e4a5792b3dbf390b

SHA1
9f08373e059a45733b70bca5a5cf24b947d93ccd

SHA256
bca5417595a8a5f269a8b3cae6e02fec6ee508badd26fc531f2d4a568fda1e24

SHA512
896645f348097fcfc2a78bc2dae19b6714c225e7309997ba9688a5170e8448034ad45516df251a01c7fdf044614002e060a24a9e98777ad6d0dfd858b2b7866d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
493KB

MD5
27889c2ec43cd414379d4931d301ed37

SHA1
958662abb73afbb6cb37c7b210689cd6d0023282

SHA256
d006bb099a52f61f2b470574fc914ab4edb9fdb83667b75eb3ed244a1752275c

SHA512
9f53ba9d30f624783613760e5414efcf64156375191f239cc0d3e63ff1915e4636f48c74aa6c43ac10e6b698a44177ef403bda7d714dcc58468aba250e9bc883

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
7.9MB

MD5
7440c36df0f59fc055c8937aee89a1ae

SHA1
1ef04b3f6672bd6250664d4980cff41a003d9420

SHA256
23fdc45cf1ba053443200a9b95316d90187219556ab0808721e0827af9f3c29b

SHA512
876c256a6d9298fa4b6a5d9c4436619637c2a43f6f1fed5b4778fbac7eebb9dfb26966e2c2d1f37c012a4e13e8fd965e3cf5ba97d2304b625dc63c3fa8878c7e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
489KB

MD5
fda63a59f6f00864ff7b4992b994df92

SHA1
3d65883b5d35dbf7b80ff3f5d1812d281156d645

SHA256
e9b342f0a903b1dfe41298dbfe103720466b104ee90c696d5af7f489b6deeb88

SHA512
5a6b74e1424ade1f1bda8a2f91c47dc17c2a5a671c6558e347790bff55b01cfaa367faec4bdba13b2ecd8e678b04307238a23d3225a4393d4d7591aaf8fcbdbe

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
87c1890da8303ed7040602d7b20dca83

SHA1
b8c6cfe3cf2486388715f1f854290186174520c1

SHA256
91360c336405111a7f0ef18cbf0f4ad95d59600cb8a1b57d2a205612b5fd13b8

SHA512
472006d4a2f77711320d71a6267aed3fbbf64336da9fc1283878fe672470c42da798ba20b0a34c0575b8346400fd4b943fd5decedfeb395632dd219151e616f3

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\prefs

Filesize
154B

MD5
2a996b1a368fa2ec691b163d65b5a18f

SHA1
8891e5b9fc1b581410b8da212315e84e25290013

SHA256
5778dffc98c8a38ccba944a4bb9bbf3f619e670e05710bcc65c1c6c8d158b084

SHA512
e65a9dae9d7a1ce2e11726e9c29fe68701bf0057c718ec21197c1b39ebc7a9b9c45c8724ded67c51528b8e545dfc6d51eed9e669eb70fc44cc65fcb5067ca324

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.4MB

MD5
49a1019b3eaf66dc7859bb15cb66b56e

SHA1
2bb25cc83ec2fc9049c176e377aa081e17c4b835

SHA256
d16040ce315f751c424ff81f8e31aa4aa8706b939c0e31b4040048813fe3996a

SHA512
db24ccaf3546e2eb786213f635f7751f0432dfee9078817d05db5c68e63d93c42e03f7c227f11d62f13b6bf0b4a145b0120a0f1e912cf27de2df3a2dc27bba73

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
674KB

MD5
e4891fff1d2ec3b05b842f7f8748138c

SHA1
2f80a8e0716b8849d71d30bb4d8225acad2aaad9

SHA256
4850882ed1bab3718d815ea31e793808c1505f92c05605cb21ba32e234b0edae

SHA512
f6d11610545a61e33798ee2a4c9ff5aad9c155c61d31879344c57a8a0b2c6767cc34f9c9ad4751966699d0eac131acb451c2b2e990d560ca07e5f60b4d31ea94

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
5.1MB

MD5
4a0013617495203068a06af8b286a530

SHA1
cdb8417885a287f0526645125bbd140fc32df337

SHA256
3c2d06b7d4c6b9e7545b89e371fee3d6db18fdf00e3aae0d90e11c9a38c35675

SHA512
3d3c4d6422512788ac4d912a949eb23d5b9525b30796967d85b08e826ee1f52b50d591bf10dc683d1a59ad82ce64da59148c0e91018802dc64ac5359ed36de10

Download Submit
memory/1128-1-0x0000000000BE0000-0x0000000000D14000-memory.dmp

Filesize
1.2MB

Download
memory/1128-0-0x00007FFF8B113000-0x00007FFF8B115000-memory.dmp

Filesize
8KB

Download
memory/1640-493-0x00007FF61B160000-0x00007FF61D425000-memory.dmp

Filesize
34.8MB

Download
memory/1640-721-0x00007FF61B160000-0x00007FF61D425000-memory.dmp

Filesize
34.8MB

Download
memory/1640-249-0x00007FF61B160000-0x00007FF61D425000-memory.dmp

Filesize
34.8MB

Download
memory/2688-32-0x00007FFF8B110000-0x00007FFF8BBD1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-25-0x00000000002B0000-0x00000000002E2000-memory.dmp

Filesize
200KB

Download
memory/2688-27-0x00007FFF8B110000-0x00007FFF8BBD1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-292-0x00007FF61B160000-0x00007FF61D425000-memory.dmp

Filesize
34.8MB

Download
memory/2688-31-0x00007FFF8B110000-0x00007FFF8BBD1000-memory.dmp

Filesize
10.8MB

Download
memory/4736-284-0x00007FFFA91B0000-0x00007FFFA91B1000-memory.dmp

Filesize
4KB

Download
memory/4736-283-0x00007FFFA74C0000-0x00007FFFA74C1000-memory.dmp

Filesize
4KB

Download
memory/4752-1190-0x000002133ED10000-0x000002133ED11000-memory.dmp

Filesize
4KB

Download
memory/4752-1191-0x000002133ED10000-0x000002133ED11000-memory.dmp

Filesize
4KB

Download
memory/4752-1192-0x000002133ED10000-0x000002133ED11000-memory.dmp

Filesize
4KB

Download
memory/4752-1182-0x000002133ED10000-0x000002133ED11000-memory.dmp

Filesize
4KB

Download
memory/4752-1189-0x000002133ED10000-0x000002133ED11000-memory.dmp

Filesize
4KB

Download
memory/4752-1184-0x000002133ED10000-0x000002133ED11000-memory.dmp

Filesize
4KB

Download
memory/4752-1183-0x000002133ED10000-0x000002133ED11000-memory.dmp

Filesize
4KB

Download
memory/4752-1188-0x000002133ED10000-0x000002133ED11000-memory.dmp

Filesize
4KB

Download
memory/4752-1193-0x000002133ED10000-0x000002133ED11000-memory.dmp

Filesize
4KB

Download
memory/4752-1194-0x000002133ED10000-0x000002133ED11000-memory.dmp

Filesize
4KB

Download