46bd8484fa170c6ac747e157417ecc753e03019312aa28f44e8619ac0355af96

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2023, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SpotifySetup.exe
Size

340KB
MD5

08610e7b5a3b6e4fc1f46ef1765fcbf1
SHA1

4df26ed2765fc4a23b670d2e2bb91be7dc92bddd
SHA256

46bd8484fa170c6ac747e157417ecc753e03019312aa28f44e8619ac0355af96
SHA512

9f078f8aaff4d7adb6696a2a5b657dfca42b1fb3008cf4aee96f3080870dc8111f75edeeecfb39dfee4cd469dca4db5a2514a18205899f9a2cf4870b70577248
SSDEEP

6144:My/woF3h0CpYIWJ7qIGv3NKNZSfDMdeegGt/rhShkKOcBnMFoKxjZO6kLyx1ddI:MQvF3kIWBqIGv3NKu+egrhShkKOcBnMy

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 8 IoCs

pid	Process
4808	SpWebInst0.exe
3688	Spotify.exe
3348	Spotify.exe
1976	Spotify.exe
3764	Spotify.exe
872	Spotify.exe
4364	Spotify.exe
4072	Spotify.exe

Loads dropped DLL 18 IoCs

pid	Process
3688	Spotify.exe
3688	Spotify.exe
3348	Spotify.exe
3348	Spotify.exe
1976	Spotify.exe
1976	Spotify.exe
1976	Spotify.exe
1976	Spotify.exe
1976	Spotify.exe
1976	Spotify.exe
872	Spotify.exe
872	Spotify.exe
3764	Spotify.exe
3764	Spotify.exe
4364	Spotify.exe
4364	Spotify.exe
4072	Spotify.exe
4072	Spotify.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2200-0-0x0000000000400000-0x00000000004DB000-memory.dmp	upx
behavioral2/memory/2200-6-0x0000000000400000-0x00000000004DB000-memory.dmp	upx
behavioral2/memory/2200-246-0x0000000000400000-0x00000000004DB000-memory.dmp	upx
behavioral2/memory/2200-245-0x0000000000400000-0x00000000004DB000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\chrome_PuffinComponentUnpacker_BeginUnzipping3688_555183068\LICENSE	Spotify.exe
File created	C:\Program Files (x86)\chrome_PuffinComponentUnpacker_BeginUnzipping3688_555183068\manifest.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_PuffinComponentUnpacker_BeginUnzipping3688_555183068\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files (x86)\chrome_PuffinComponentUnpacker_BeginUnzipping3688_555183068\manifest.fingerprint	Spotify.exe
File created	C:\Program Files (x86)\chrome_PuffinComponentUnpacker_BeginUnzipping3688_555183068\_platform_specific\win_x86\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files (x86)\chrome_PuffinComponentUnpacker_BeginUnzipping3688_555183068\_platform_specific\win_x86\widevinecdm.dll	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\spotify	Spotify.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe
Token: SeShutdownPrivilege	3688	Spotify.exe
Token: SeCreatePagefilePrivilege	3688	Spotify.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3688	Spotify.exe
3688	Spotify.exe
3688	Spotify.exe
3688	Spotify.exe
3688	Spotify.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3688	Spotify.exe
3688	Spotify.exe
3688	Spotify.exe
3688	Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 4808	2200	SpotifySetup.exe	93
PID 2200 wrote to memory of 4808	2200	SpotifySetup.exe	93
PID 2200 wrote to memory of 4808	2200	SpotifySetup.exe	93
PID 4808 wrote to memory of 3688	4808	SpWebInst0.exe	97
PID 4808 wrote to memory of 3688	4808	SpWebInst0.exe	97
PID 4808 wrote to memory of 3688	4808	SpWebInst0.exe	97
PID 3688 wrote to memory of 3348	3688	Spotify.exe	99
PID 3688 wrote to memory of 3348	3688	Spotify.exe	99
PID 3688 wrote to memory of 3348	3688	Spotify.exe	99
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 1976	3688	Spotify.exe	100
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101
PID 3688 wrote to memory of 3764	3688	Spotify.exe	101

C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe
"C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.24.756 --initial-client-data=0x40c,0x410,0x414,0x408,0x418,0x67eb3c48,0x67eb3c58,0x67eb3c64
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3348
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/117.0.5938.150 Spotify/1.2.24.756" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1844 --field-trial-handle=1848,i,9786757913577479954,16752067910502889727,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1976
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/117.0.5938.150 Spotify/1.2.24.756" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2892 --field-trial-handle=1848,i,9786757913577479954,16752067910502889727,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3764
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/117.0.5938.150 Spotify/1.2.24.756" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3588 --field-trial-handle=1848,i,9786757913577479954,16752067910502889727,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:872
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/117.0.5938.150 Spotify/1.2.24.756" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --first-renderer-process --autoplay-policy=no-user-gesture-required --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4016 --field-trial-handle=1848,i,9786757913577479954,16752067910502889727,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4364
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/117.0.5938.150 Spotify/1.2.24.756" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=732 --field-trial-handle=1848,i,9786757913577479954,16752067910502889727,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\chrome_PuffinComponentUnpacker_BeginUnzipping3688_555183068\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files (x86)\chrome_PuffinComponentUnpacker_BeginUnzipping3688_555183068\manifest.json

Filesize
984B

MD5
0359d5b66d73a97ce5dc9f89ed84c458

SHA1
ce17e52eaac909dd63d16d93410de675d3e6ec0d

SHA256
beeab2f8d3833839399dde15ce9085c17b304445577d21333e883d6db6d0b755

SHA512
8fd94a098a4ab5c0fcd48c2cef2bb03328dd4d25c899bf5ed1ca561347d74a8aab8a214ba2d3180a86df72c52eb26987a44631d0ecd9edc84976c28d6c9dc16a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
8e19da532646085255ca8617ad09b175

SHA1
f034d78cc28dff9edd6f657ac53188ef11163a15

SHA256
0bc20117c7a2516732a51d110d5d6891c102c0d936aa4efcc0d69044fd19abe0

SHA512
bf496c7a4e561bb33c311a20d9fcc482c6aa9f31261ac3847cd5dafeb07cae74b91388958156d318f8fde4ee4dd2779599eb36df30f2826255fd0d440692ed50

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe58725c.TMP

Filesize
48B

MD5
0d5a8f4379646202dc9b18b28144fa65

SHA1
5ba485c314cd8daf0cda35fd795e6b1001d03d68

SHA256
4215f36cd6c5e98da4705012a2da169311105d0266cd6585ad0565589d981f9d

SHA512
9d830a4d131a2150975f7eb9235172c225c86eeb573cb5a17f03158543d5ee010755229a8fa8ad2f2bc9f4153fb3b8835f86e7a0453ce228050b3ca3f7db7d8e

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State

Filesize
1KB

MD5
5c9608723cda14fd32c7aa24fc309e6d

SHA1
1e85efe3b8f7cc5c7ddf8831389533c67f6ac407

SHA256
8b98bb3f4a11cf181a428e0843529a3c186da7220ce80601ea4933b0a7aa1355

SHA512
63c5d655a698b052460682d75d2d98fdfa005ecb9884963ad6c88ed4070132302abd945cbf430bf8574fed7996dff3d7cc4ef8a805284900e2e28cbe3c67ab4d

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe596c6c.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity

Filesize
524B

MD5
4991eac00d79b0ae5a2864dabf13f942

SHA1
a0aeb8306746a3486d4ac1bd0ba482f62be0f720

SHA256
8f42bee25f0a34391bfa6b91dbf38009cdb020f8cb096eb539f66159ad0cb305

SHA512
476462ee2f8231438ab28a9b7948ac3d5ee8f759cc8c9755c3e3a38ad92f0b78d776966a88446c287463c11416e64b511882b62d6d8888f23860ccfb6704d2e4

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity~RFe587450.TMP

Filesize
524B

MD5
65fbea500f16d2cba3806754e9e6b650

SHA1
95c52d2f35f91d22b922ab8dc68f80d0ac7f9a40

SHA256
090461da4c04b72bcfcdc55b30032fa6f7118acfe590ae956f562c75ba710e56

SHA512
ba5843fad3f7121de976358cc5efbc2eceaabd9aee773778cb86de53515135a56e87d61d443e16ec0c55b5da9c55e3b448774034b3f8be0fc0b5018785ab4f60

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
717B

MD5
f7fe2f25071dce9326cde8bcc84fd297

SHA1
73e7dfebe33e7a6f34a1a82deede9e2025f45f86

SHA256
44a874c0631626c834feb88c7abfa3714551a3a4e2fe06cc54672aefdda7edf0

SHA512
4e53e37a6b5de75182599a97ea1b9a358525a5c7712ab2ff1e1c9dff35cc6b309c1d07128c9e05e8dd28e21ce9aea075d6364a4a6e9b0eaf1984052ecb545140

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe5861a3.TMP

Filesize
529B

MD5
0a23206f3e2d06f3f31825e57c0b35d1

SHA1
6a0b7e1517ca4c9853bce9da8f6f196f9bd9f718

SHA256
7c1f991145430848151405dd058f8c18f1cb988cc0875b4f1564da613c19c752

SHA512
72542d834545781bcb6eeb3e65466acca6720ed2fe21f42c2e88394803593fbac3775fbe9f3ecd6584d747280ef4d7f6d029afaf232e1045871ada05ac176211

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
3655861c6a8767fcb02bed8559eeb632

SHA1
c9fc33cd986aa69c0d096c46fafce34b389396de

SHA256
bbd47b279e34163d7b0eb8a6e55646b05170ae49c02b8f4694c9c428c555f6cb

SHA512
dfc763ca92c0de1b7771e537b620f981ffa018faf55c7fe49981d227ecbcac547af011920ce0f7c9e432564b7e6893fff4b73bd6c6c68bcf674e7c83815a57cd

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
2.6MB

MD5
1e376ae1c4618b1ae506af4de4c7eac0

SHA1
fa05c3b9b66ab9af3e5e5c51f958338709539b55

SHA256
101a87ede98d17a5f3f128e143ffdb7b1af3bd1fb59233c2e99abe3767920601

SHA512
85dbbe56a09207e5880b8069785ed5b13d71f181e77a1fa3aa1ff9636894371c0f4bc424b66697967f57eea72ff2755b1f1c647cd20f82485f2a361d5fac3db8

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll

Filesize
3.9MB

MD5
f43c7b61009649eb40ac8eff7ca28980

SHA1
13cc6844405a57b91a376204c925990b6342b4c9

SHA256
64fe5237b68636aa1fea2b1e5bf5ee38692394a8163f078874e3e34068d21ede

SHA512
9b03b525274316e5b916fc0bc0ee4cca7acca3eefa90e64403008e97585cfebb42ceac35a5c24134901eef2c78daefae9d58492b921b9502873a2ce48b55d451

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe

Filesize
90.8MB

MD5
e92ecac43ab67353bec2a7c3cff5954a

SHA1
f2a6e90cb08c72fb853a2d38366694cb628fa1b6

SHA256
c8347c1ec66e992ea0d6317f6ad67cbd331f5ad35b3b3c005747b23a6ff7e3c3

SHA512
9b6129db9de44b740da9de4843b3cedac1fcdadae1c489e5b2494fa4121e6be0687e620040783d634887404a978d1bd436c289c735da1b9ee02018c49ea1775d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe

Filesize
90.8MB

MD5
e92ecac43ab67353bec2a7c3cff5954a

SHA1
f2a6e90cb08c72fb853a2d38366694cb628fa1b6

SHA256
c8347c1ec66e992ea0d6317f6ad67cbd331f5ad35b3b3c005747b23a6ff7e3c3

SHA512
9b6129db9de44b740da9de4843b3cedac1fcdadae1c489e5b2494fa4121e6be0687e620040783d634887404a978d1bd436c289c735da1b9ee02018c49ea1775d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
20.9MB

MD5
c122bff7a1b5289d8c8e938ae77a9736

SHA1
7a137f50041bcddd7e66b86fc84d5229d3b3d2c2

SHA256
2c8d4bde8db3c3f8d5d4224feb9fda8011a3faf1ec201298261e93f8f03190b1

SHA512
75f4bc41394857a16f77249e4d1dabdc1d15276eeeff6294b84b0fd7a4ea309caa1db614faa0fe2497986258fe63282927646e61883ca72372194e297c576192

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
20.9MB

MD5
c122bff7a1b5289d8c8e938ae77a9736

SHA1
7a137f50041bcddd7e66b86fc84d5229d3b3d2c2

SHA256
2c8d4bde8db3c3f8d5d4224feb9fda8011a3faf1ec201298261e93f8f03190b1

SHA512
75f4bc41394857a16f77249e4d1dabdc1d15276eeeff6294b84b0fd7a4ea309caa1db614faa0fe2497986258fe63282927646e61883ca72372194e297c576192

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
20.9MB

MD5
c122bff7a1b5289d8c8e938ae77a9736

SHA1
7a137f50041bcddd7e66b86fc84d5229d3b3d2c2

SHA256
2c8d4bde8db3c3f8d5d4224feb9fda8011a3faf1ec201298261e93f8f03190b1

SHA512
75f4bc41394857a16f77249e4d1dabdc1d15276eeeff6294b84b0fd7a4ea309caa1db614faa0fe2497986258fe63282927646e61883ca72372194e297c576192

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
20.9MB

MD5
c122bff7a1b5289d8c8e938ae77a9736

SHA1
7a137f50041bcddd7e66b86fc84d5229d3b3d2c2

SHA256
2c8d4bde8db3c3f8d5d4224feb9fda8011a3faf1ec201298261e93f8f03190b1

SHA512
75f4bc41394857a16f77249e4d1dabdc1d15276eeeff6294b84b0fd7a4ea309caa1db614faa0fe2497986258fe63282927646e61883ca72372194e297c576192

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
20.9MB

MD5
c122bff7a1b5289d8c8e938ae77a9736

SHA1
7a137f50041bcddd7e66b86fc84d5229d3b3d2c2

SHA256
2c8d4bde8db3c3f8d5d4224feb9fda8011a3faf1ec201298261e93f8f03190b1

SHA512
75f4bc41394857a16f77249e4d1dabdc1d15276eeeff6294b84b0fd7a4ea309caa1db614faa0fe2497986258fe63282927646e61883ca72372194e297c576192

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
20.9MB

MD5
c122bff7a1b5289d8c8e938ae77a9736

SHA1
7a137f50041bcddd7e66b86fc84d5229d3b3d2c2

SHA256
2c8d4bde8db3c3f8d5d4224feb9fda8011a3faf1ec201298261e93f8f03190b1

SHA512
75f4bc41394857a16f77249e4d1dabdc1d15276eeeff6294b84b0fd7a4ea309caa1db614faa0fe2497986258fe63282927646e61883ca72372194e297c576192

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
20.9MB

MD5
c122bff7a1b5289d8c8e938ae77a9736

SHA1
7a137f50041bcddd7e66b86fc84d5229d3b3d2c2

SHA256
2c8d4bde8db3c3f8d5d4224feb9fda8011a3faf1ec201298261e93f8f03190b1

SHA512
75f4bc41394857a16f77249e4d1dabdc1d15276eeeff6294b84b0fd7a4ea309caa1db614faa0fe2497986258fe63282927646e61883ca72372194e297c576192

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
20.9MB

MD5
c122bff7a1b5289d8c8e938ae77a9736

SHA1
7a137f50041bcddd7e66b86fc84d5229d3b3d2c2

SHA256
2c8d4bde8db3c3f8d5d4224feb9fda8011a3faf1ec201298261e93f8f03190b1

SHA512
75f4bc41394857a16f77249e4d1dabdc1d15276eeeff6294b84b0fd7a4ea309caa1db614faa0fe2497986258fe63282927646e61883ca72372194e297c576192

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
630KB

MD5
063ba1f7817a0337bd678fcbd320646e

SHA1
ef4253b6aa1d3199c8b44e4e6b0c6714793290b9

SHA256
dae31a405dd524ce81cdb498e5da0769a642ccac94e6c5348c313e8ed7a456bb

SHA512
27b430aa2a93e182f473c81211cb8aa291a2a887f1bf7bd6228a8fa00ba5867ac4e4b09a63ec482cab0d64cf643f600246b883d3d22d56bbd585ad67bc5fb6e4

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
972KB

MD5
ee6066650eb7ec134f828256ca259496

SHA1
3047ea6556ca92d7b31f91b7e214d011f123c231

SHA256
13aad20eb12608e59a609fda007a538686d2c978d850be01ad4fb8edf4332b22

SHA512
b96ab0931080a3b73e42678f6093cd1706707d40535e773760553aeb8fa6124096dd81326161402522f13ce10ab466e4260e3120d22d7c7bc04a62b33ed19764

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
a47812b4ccdf24786936ed4655580955

SHA1
21c1263d254822e9022706c62e95c9b6fb0fe3cc

SHA256
ff7fcb6c5278a4799324c2090dd039815b6e43a15f3fdbf09a39ff1c209c6275

SHA512
07498841eff40a574f257b069c405b8af2eb9284ef97751217970ad54801291cb6956b73ff6fe31d40d903872d558df1277f4bf71e1e8b12ea996f7b25702eee

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
a47812b4ccdf24786936ed4655580955

SHA1
21c1263d254822e9022706c62e95c9b6fb0fe3cc

SHA256
ff7fcb6c5278a4799324c2090dd039815b6e43a15f3fdbf09a39ff1c209c6275

SHA512
07498841eff40a574f257b069c405b8af2eb9284ef97751217970ad54801291cb6956b73ff6fe31d40d903872d558df1277f4bf71e1e8b12ea996f7b25702eee

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
a47812b4ccdf24786936ed4655580955

SHA1
21c1263d254822e9022706c62e95c9b6fb0fe3cc

SHA256
ff7fcb6c5278a4799324c2090dd039815b6e43a15f3fdbf09a39ff1c209c6275

SHA512
07498841eff40a574f257b069c405b8af2eb9284ef97751217970ad54801291cb6956b73ff6fe31d40d903872d558df1277f4bf71e1e8b12ea996f7b25702eee

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
a47812b4ccdf24786936ed4655580955

SHA1
21c1263d254822e9022706c62e95c9b6fb0fe3cc

SHA256
ff7fcb6c5278a4799324c2090dd039815b6e43a15f3fdbf09a39ff1c209c6275

SHA512
07498841eff40a574f257b069c405b8af2eb9284ef97751217970ad54801291cb6956b73ff6fe31d40d903872d558df1277f4bf71e1e8b12ea996f7b25702eee

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
a47812b4ccdf24786936ed4655580955

SHA1
21c1263d254822e9022706c62e95c9b6fb0fe3cc

SHA256
ff7fcb6c5278a4799324c2090dd039815b6e43a15f3fdbf09a39ff1c209c6275

SHA512
07498841eff40a574f257b069c405b8af2eb9284ef97751217970ad54801291cb6956b73ff6fe31d40d903872d558df1277f4bf71e1e8b12ea996f7b25702eee

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
a47812b4ccdf24786936ed4655580955

SHA1
21c1263d254822e9022706c62e95c9b6fb0fe3cc

SHA256
ff7fcb6c5278a4799324c2090dd039815b6e43a15f3fdbf09a39ff1c209c6275

SHA512
07498841eff40a574f257b069c405b8af2eb9284ef97751217970ad54801291cb6956b73ff6fe31d40d903872d558df1277f4bf71e1e8b12ea996f7b25702eee

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
a47812b4ccdf24786936ed4655580955

SHA1
21c1263d254822e9022706c62e95c9b6fb0fe3cc

SHA256
ff7fcb6c5278a4799324c2090dd039815b6e43a15f3fdbf09a39ff1c209c6275

SHA512
07498841eff40a574f257b069c405b8af2eb9284ef97751217970ad54801291cb6956b73ff6fe31d40d903872d558df1277f4bf71e1e8b12ea996f7b25702eee

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.1MB

MD5
a47812b4ccdf24786936ed4655580955

SHA1
21c1263d254822e9022706c62e95c9b6fb0fe3cc

SHA256
ff7fcb6c5278a4799324c2090dd039815b6e43a15f3fdbf09a39ff1c209c6275

SHA512
07498841eff40a574f257b069c405b8af2eb9284ef97751217970ad54801291cb6956b73ff6fe31d40d903872d558df1277f4bf71e1e8b12ea996f7b25702eee

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
681B

MD5
273aa6b10f0c721ee83908efd972e6e1

SHA1
ce2592c5a42371c361a42c8e2fe07f644abe90f0

SHA256
6a1f2d4ba53ae03c37105f00913a32fb5354a241d8045fb3cddb3b21e1cdd5d4

SHA512
72ffc795b78f71e90c08ca65e8ed46096220196009bf2fae4a2a89d76c4c9eb699575cb9d8407f7c3a9581d0f3fe6f1fd757378bb006ce374461c22bcfba5094

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
f43c7b61009649eb40ac8eff7ca28980

SHA1
13cc6844405a57b91a376204c925990b6342b4c9

SHA256
64fe5237b68636aa1fea2b1e5bf5ee38692394a8163f078874e3e34068d21ede

SHA512
9b03b525274316e5b916fc0bc0ee4cca7acca3eefa90e64403008e97585cfebb42ceac35a5c24134901eef2c78daefae9d58492b921b9502873a2ce48b55d451

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.2MB

MD5
e0f1ad85c0933ecce2e003a2c59ae726

SHA1
a8539fc5a233558edfa264a34f7af6187c3f0d4f

SHA256
f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb

SHA512
714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
379KB

MD5
74f25c17c24d560072359f603a0efdb7

SHA1
2deadc4bb35f1073a61916df911f0691db28e638

SHA256
760178ea0d4347414cbbabb4295bde0d366f3c3168261bb1869a879398f0aa48

SHA512
3d91b4b19931b6ce9a00f2aa5175a11d78991d819d30ffb86b91b232bfe77ebdd30deeb7969680c9ce3a5b14da3bdf5f1a5d94fcf4ff213d6608d72451d0d19f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
6.3MB

MD5
22f507652342129d9ee9e115281a0335

SHA1
f181137cdaa587d38881adf09b8b1a431562afe6

SHA256
d8039443f191371d8d01f7fd7d1ad0f97e57b826bc219171243d752754e40170

SHA512
5b1542bbda67da8c0f3296017dd886cf66c6e357120d71e924de228bdd297689e82e42274f39d590ca3ddccbcc996950ea9d8bc9c3467ac5655fd05fc505cf67

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
166.4MB

MD5
a7d37bf93866d8e27ecfeb4c2ae724d9

SHA1
60f846156d6c2b44c560a4d74063baedc89a72ff

SHA256
ac24e000f507b9b7837addc92a2ff1e5efb057c25c468362d97e7bf0e854642a

SHA512
9927bfb2bc7e2769a33dda86b637579cb9d70678583b235cb5e7d7c162ad044b5480d3c930e4b0a6f005fac7f802e79a00cc8d2e7316b3c5a8e645a3feafc17f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
166.4MB

MD5
a7d37bf93866d8e27ecfeb4c2ae724d9

SHA1
60f846156d6c2b44c560a4d74063baedc89a72ff

SHA256
ac24e000f507b9b7837addc92a2ff1e5efb057c25c468362d97e7bf0e854642a

SHA512
9927bfb2bc7e2769a33dda86b637579cb9d70678583b235cb5e7d7c162ad044b5480d3c930e4b0a6f005fac7f802e79a00cc8d2e7316b3c5a8e645a3feafc17f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
166.4MB

MD5
a7d37bf93866d8e27ecfeb4c2ae724d9

SHA1
60f846156d6c2b44c560a4d74063baedc89a72ff

SHA256
ac24e000f507b9b7837addc92a2ff1e5efb057c25c468362d97e7bf0e854642a

SHA512
9927bfb2bc7e2769a33dda86b637579cb9d70678583b235cb5e7d7c162ad044b5480d3c930e4b0a6f005fac7f802e79a00cc8d2e7316b3c5a8e645a3feafc17f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
166.4MB

MD5
a7d37bf93866d8e27ecfeb4c2ae724d9

SHA1
60f846156d6c2b44c560a4d74063baedc89a72ff

SHA256
ac24e000f507b9b7837addc92a2ff1e5efb057c25c468362d97e7bf0e854642a

SHA512
9927bfb2bc7e2769a33dda86b637579cb9d70678583b235cb5e7d7c162ad044b5480d3c930e4b0a6f005fac7f802e79a00cc8d2e7316b3c5a8e645a3feafc17f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
166.4MB

MD5
a7d37bf93866d8e27ecfeb4c2ae724d9

SHA1
60f846156d6c2b44c560a4d74063baedc89a72ff

SHA256
ac24e000f507b9b7837addc92a2ff1e5efb057c25c468362d97e7bf0e854642a

SHA512
9927bfb2bc7e2769a33dda86b637579cb9d70678583b235cb5e7d7c162ad044b5480d3c930e4b0a6f005fac7f802e79a00cc8d2e7316b3c5a8e645a3feafc17f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
166.4MB

MD5
a7d37bf93866d8e27ecfeb4c2ae724d9

SHA1
60f846156d6c2b44c560a4d74063baedc89a72ff

SHA256
ac24e000f507b9b7837addc92a2ff1e5efb057c25c468362d97e7bf0e854642a

SHA512
9927bfb2bc7e2769a33dda86b637579cb9d70678583b235cb5e7d7c162ad044b5480d3c930e4b0a6f005fac7f802e79a00cc8d2e7316b3c5a8e645a3feafc17f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
166.4MB

MD5
a7d37bf93866d8e27ecfeb4c2ae724d9

SHA1
60f846156d6c2b44c560a4d74063baedc89a72ff

SHA256
ac24e000f507b9b7837addc92a2ff1e5efb057c25c468362d97e7bf0e854642a

SHA512
9927bfb2bc7e2769a33dda86b637579cb9d70678583b235cb5e7d7c162ad044b5480d3c930e4b0a6f005fac7f802e79a00cc8d2e7316b3c5a8e645a3feafc17f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
83.7MB

MD5
c5c0205c710b3b23af5a553ac00b23f3

SHA1
173c6778aae2aeb45fa59da20c8fc0b72e03bfb8

SHA256
42bdbca4b767616380ac46e2cb66854024ddbfb5c0c0e7652e7c639e48b3f6cb

SHA512
6a40d6d21f98f2f7afce5d71fe4677cd8327514bdb2b4c81fe84b6aa3206842bd2a3705f85ac868c2323710e2d39261469c52520f9b3ea58c2f63c60b24f6c0a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll

Filesize
379KB

MD5
74f25c17c24d560072359f603a0efdb7

SHA1
2deadc4bb35f1073a61916df911f0691db28e638

SHA256
760178ea0d4347414cbbabb4295bde0d366f3c3168261bb1869a879398f0aa48

SHA512
3d91b4b19931b6ce9a00f2aa5175a11d78991d819d30ffb86b91b232bfe77ebdd30deeb7969680c9ce3a5b14da3bdf5f1a5d94fcf4ff213d6608d72451d0d19f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
6.3MB

MD5
22f507652342129d9ee9e115281a0335

SHA1
f181137cdaa587d38881adf09b8b1a431562afe6

SHA256
d8039443f191371d8d01f7fd7d1ad0f97e57b826bc219171243d752754e40170

SHA512
5b1542bbda67da8c0f3296017dd886cf66c6e357120d71e924de228bdd297689e82e42274f39d590ca3ddccbcc996950ea9d8bc9c3467ac5655fd05fc505cf67

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
419KB

MD5
6355971e5261e4243746fcd14ed92cd7

SHA1
825388f1bcfb000269b90cf38f4e729c2596e4fe

SHA256
37d470533d91de21d4ab7f3482514accf92078facd272f557339d3d7a0bf0f85

SHA512
63e53d263e5d23eaf30de8f2e24512ad12528357b400c23d238828f04fff1bd57cde5e4b4c3276c80fb86738fe03777f333ae0f04a3eaab8ea7bc8271919fcf0

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
14KB

MD5
a6bf0c9a34f7ef167506b61405c9864a

SHA1
00c09ed528c365600033698b8005220b40e427ca

SHA256
9f5378fdd3b2df5f4ac2e78330514ef9ba1fa9eb4cf9effda9ed129243795433

SHA512
4aaf630313e188cefa3e4b4e08876ee9516f2123de0fcf2ddfc6c3c952345dd36329e49fe10e5a4404a2bc3b59a2e50609fcc4f27cb6612817a178aee4479e2c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
7.8MB

MD5
a43724d72d0f1fc3c3f8ab56e6911348

SHA1
f73cb7087ef6f00a7a2a7b68d903579c6ba27edc

SHA256
12531143674abb0e210a53ff6427c761f218e1afd30a7155cab6135e5cb4d47c

SHA512
d3f0bff4aa53677553af7e39946105c893204536e95ee630f67bf87e6e251b8216cbbca1973fbab3bee96ccf6362f1ab83cc555a0d8f9abbb166e216c8611281

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
601KB

MD5
eafaa376bccdd2a89a7bc848f447483e

SHA1
e9f0f4a36786e22603cf262f12098f3aa7ee1b97

SHA256
26cae38fc4e5b9c527aab16ee6595449466e5ebb074e14c27a12976af580e6e2

SHA512
4463d4a6fba99301506321ff667e1a2d51e9daab774bf50887dfb9b4c3986693ea8be5cbb48146a66b94cbd4d1b59e1aaff0e2f6bc358e01b552e50e21278b0b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.2MB

MD5
3948fda463d8cfbe8e2446cd890248ab

SHA1
5bbb6450a7451dfabe5612abd90a177ef3843950

SHA256
d2712c65eceae1160f644aa1b87793c336275bea05259f79ddaacdc1636e7fa6

SHA512
72eda0060b628fb3053802984d5a59e8b243aa41c116a5862adacc001ccfa6765c190b5f6d45b9ab667c9033d76ee9d15031ac1d42eea2cbcf67319fec015420

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
4.2MB

MD5
3948fda463d8cfbe8e2446cd890248ab

SHA1
5bbb6450a7451dfabe5612abd90a177ef3843950

SHA256
d2712c65eceae1160f644aa1b87793c336275bea05259f79ddaacdc1636e7fa6

SHA512
72eda0060b628fb3053802984d5a59e8b243aa41c116a5862adacc001ccfa6765c190b5f6d45b9ab667c9033d76ee9d15031ac1d42eea2cbcf67319fec015420

Download Submit
memory/872-292-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/1976-248-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/1976-375-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/2200-245-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/2200-6-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/2200-246-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/2200-0-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/3348-374-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/3348-228-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/3688-364-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/3688-209-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/3764-376-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/3764-289-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/4072-413-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/4072-394-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/4364-377-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download
memory/4364-330-0x0000000000400000-0x000000000190E000-memory.dmp

Filesize
21.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads