5afd8bd60ba9311696fe939e0c280ac5aa28fab8554fda14a4366cddf7d0e6b8

Analysis

user interaction
yes
max time kernel
31s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Spotify 1.0.8.exe
Size 60.7MB
Sample260421-1an2jsb16m
SHA256 5afd8bd60ba9311696fe939e0c280ac5aa28fab8554fda14a4366cddf7d0e6b8
MD5 a0f36ca24bf9df230afe59b6e4dd4f53
SHA1 db76eac15d0961d76139d754605fab6f4196a15b
SHA512 fc187f1eb22b364d51a8414b9b59be9b38cf9c4d98268f12076104323459014087ee1b0ecba920ef38bfb262d097e49f63bc2c9b3b0f7f2d040611a8b37cc999
SSDEEP 1572864:iMtbJTN8P25lc6AQLks5TK+x1hBeD2uX5ftvr:pbq25lsQL9xNu
TLSH
T123D73320F5018039EDB651B9C81EA779F53DAE924F68EDCF53CD617825386C2293362B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery persistence spyware

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Spotify.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Spotify.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Spotify.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Spotify.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Spotify.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Spotify.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	Spotify.exe

Executes dropped EXE 6 IoCs

pid	Process
3188	Spotify.exe
5068	Spotify.exe
5196	Spotify.exe
5880	SpotifyWebHelper.exe
4268	Spotify.exe
2208	Spotify.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Wine	Spotify.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Wine	Spotify.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Wine	Spotify.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Wine	Spotify.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Wine	Spotify.exe

Loads dropped DLL 13 IoCs

pid	Process
3188	Spotify.exe
3188	Spotify.exe
5068	Spotify.exe
5068	Spotify.exe
5196	Spotify.exe
5196	Spotify.exe
5196	Spotify.exe
5196	Spotify.exe
5196	Spotify.exe
4268	Spotify.exe
4268	Spotify.exe
2208	Spotify.exe
2208	Spotify.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify Web Helper = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\SpotifyWebHelper.exe --autostart"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify 1.0.8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpotifyWebHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3188	Spotify.exe
3188	Spotify.exe
3188	Spotify.exe
3188	Spotify.exe
3188	Spotify.exe
3188	Spotify.exe
3188	Spotify.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
3188	Spotify.exe
3188	Spotify.exe
3188	Spotify.exe
3188	Spotify.exe
3188	Spotify.exe
3188	Spotify.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 3188	4344	Spotify 1.0.8.exe	85
PID 3188 wrote to memory of 5068	3188	Spotify.exe	89
PID 3188 wrote to memory of 5196	3188	Spotify.exe	93
PID 3188 wrote to memory of 5880	3188	Spotify.exe	94
PID 3188 wrote to memory of 4268	3188	Spotify.exe	99
PID 3188 wrote to memory of 4268	3188	Spotify.exe	99

C:\Users\Admin\AppData\Local\Temp\Spotify 1.0.8.exe
"C:\Users\Admin\AppData\Local\Temp\Spotify 1.0.8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  Spotify.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.0.80.474 --initial-client-data=0x588,0x58c,0x590,0x584,0x594,0x747b8718,0x747b8728,0x747b8734
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-d3d11 --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --log-severity=disable --product-version=Spotify/1.0.80.474 --lang=en-US --gpu-preferences=KAAAAAAAAAAABwAAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor=Microsoft --gpu-driver-version=10.0.19041.868 --gpu-driver-date=6-21-2006 --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --log-severity=disable --product-version=Spotify/1.0.80.474 --lang=en-US --service-request-channel-token=75DA35827C03A2F920CB597CCEFA2689 --mojo-platform-channel-handle=1992 --ignored=" --type=renderer " /prefetch:2
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5196
- - C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5880
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --service-pipe-token=689B9991B0485EF8FFBAEE30044EFBF0 --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --log-severity=disable --product-version=Spotify/1.0.80.474 --disable-spell-checking --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=689B9991B0485EF8FFBAEE30044EFBF0 --renderer-client-id=3 --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4268

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CURRENT

Path C:\Users\Admin\AppData\Local\Spotify\Browser\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Spotify\Browser\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Size 56B
SHA256 a8ab397671c1e2880dac65b9d2f9165ed4741c1923c1f0cd248f9a4cda373abb
MD5 237cf618f2021cc64fc1717cf873260d
SHA1 4dd2eb3d8b89e564fc5aefceb2aa5d172db7b29f
SHA512 50d5ccee79ec68dee1eef10d21944b625cdef64c0d5046451709a7367f76aa76f3705cc73afae1740d2e67d7419389e5535b2ac915c95cd108ef4ad65d22f502
MD5 SHA1 SHA512

Submit Download

glue-resources.spa

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\glue-resources.spa
Size 764KB
SHA256 a0598c1fa8461b962b93cf91c71053bf40179f85fd4f3fcfdb5025c261bfbc58
MD5 64cc217182c5687c6202ac54f40e79ad
SHA1 0c9acdd421a11b3a0f938a72c11d33f35b1dddf5
SHA512 3c01bef06a0f04a72a48703ba89d3936ab9e5d8b07113122879c5443740a2a12c578bc906853d2814baceac9aa9ae9398bf92d2a2ac1c3928bcbc9c3d1b6f1a9
SSDEEP 12288:/kC1bKeNOnGddONWMNUrwQ/O9LY08vE9oRrd79upIUfSVlA3WTAz3gjusRcoXij0:/LBKeNvd8NwrwLtYdvESrd7A7fSVlAot
TLSH
T198F423F0C975EE53E93AB87D112968A823FD4C6A3107D828730586FDDFC22E96560DB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
Size 272KB
SHA256 ff5bf4117e0fb241643ad12cb3f9080e0b04923fe85e09059f384478571a766e
MD5 88d364bc534402c36d987861eb050551
SHA1 efe31d3c390fe6a4c07191faae8b34967aec5901
SHA512 9efca0e33b3af4cc7d3ea98f5155fb6dcb9e19e1fa101769276992db96562d1ad9207c04c668c70092eafcc3c447f82ac1844f5b43d13534170b27c8d9f6faeb
SSDEEP 6144:jQYbupIU91SNflZ1hqDUHl8RdGncLV1SE5ih/3ShaeuQBgwMJ:j9upIUfSVlZ1hqDUQOcTSE81rwgw6
TLSH
T11B44239491C5737FFC13D278913EB66E0B191B22A64270F7AFB561850D8BB40C9F88A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll
Size 3.5MB
SHA256 174a713068a155c74823057ea413231ee1aaf584045db0ab3f9b7c4ce1771263
MD5 f4464180525c9c6acd0afadb5fbc140e
SHA1 f8f9ff651821a7f3a121355801bf0e094b97b0f5
SHA512 dd7abeca9eddb927e059cd154cf4a28a32855d80316288cf3a2cd49e3aed2779c4904f9d2f598f4ef9a4cb8b5b7bd21ab4430ff85562380436a9d3ab31bdf85a
SSDEEP 49152:vVBD1/zMxpjAeHhtiv2dGDwhMeX1/iK6AoVCdUTFEt:v7ZMxpjAeHhtivBDwh1c51y
TLSH
T1CB069E21FB018076D8CB01B365AD7BA6A46C9731473441C3E19CAE55ED707E32B3AF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 22.1MB
SHA256 c79d17b22f347e44cac27081d2540b45d668a3d7ed3c23481e4ae99af6b6ee7d
MD5 8f474d812971838c7091147c8c996b5a
SHA1 27ad28a6455ac360e752fd9651959174df7d5fa1
SHA512 1479c2374dce018d037c9b8e55ae20cdd1e4f93e88003e983db9e92a03d2af98792d163cecbb141f78239d97e6111db0c6ae124c87a6a3b9b9140c4a222a6b01
SSDEEP 393216:B3bKIpbCfgLa2PVtdVdqP+bTgzLVNdPbVfAw:JbLpbCfgLjPHdemoNdTVD
TLSH
T1EF376B21F605C13BE48243F1992DDF6E871C9A790B7806C7A3D85F696E748D32F3285A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpotifyWebHelper.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe
Size 764KB
SHA256 ca0a19f2fbfb34fcdf2d744ad81af57e25bee88b00422181279e2e3116f044ed
MD5 0abbf9989224441d3b5b4eb9ce6d879d
SHA1 d629dce38b4c5bb0a5547825b754e68320599e1f
SHA512 daf651558721b1b50567093c017d9f1a225ed7852a37fdb9fa1960fa3276fa7a0f9c0887f0a8f9d62079ed7d8b07c81608de338b0694bcf83bfabbd3dc584789
SSDEEP 12288:R9lYYPETNpkS00mvoJ61ypAFa3DtWtX2/3HmiXuQb9rzrhBzTt94RIORfp6b55k3:j6nWtX2/3HmiXuQb9rzrhBzTt94CC6bc
TLSH
T1E5F47C203582C07BD6A201B24D38AA7E506EFA650F391AD7E3DC1B1D6E785C35F3265B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\cef.pak
Size 3.7MB
SHA256 6dbad9ccdd753112dcf9b7ab7fab653f3e3b7df4e1e38747657581c37c5b646b
MD5 9047b65198083c68f832df1469a1cf3c
SHA1 9f86b90f9c8f1e5c3819c32edfce88a409879cd8
SHA512 54a307aaa47ad4909a87a117a02ed36d82a5d98c0d60747fc7438fc9ce4b964de62d48f503fa468e5d81d8b44d57718b4f953864dc21b175a81f3bb1b8997d92
SSDEEP 49152:KyhCtNQsY2A+6kmxiLFRuzk+wwJbeuR/oSHPtolWGHHeH06rLSbiu1vU0t+wH30o:SxRuPvAPEwEsm8xTPpZ
TLSH
T12B069E693AF61132C0276479AB8F6185FB35800B1126E9547CEC97AC1F89F7442B7FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\cef_100_percent.pak
Size 639KB
SHA256 e05c3fc057f70b986bc4013308cf9f84a2d2b6358c3a78506ef1958ce70a3b37
MD5 35d8e082134e02cfac7384c16ea50217
SHA1 7115f659d0c3243d0a59fdd967a0b27811ce56d7
SHA512 118fccad56479adde785dc4e97b2e56c0db30cd47036705924ff34f8e99d0c3911cd78e2c99c2c90449481d6a0b551f8f5c771e988b2a0b9c117f6582583b75f
SSDEEP 6144:+oKw/51lxHcSgEal9Dxd0NvmxzaK1RXaDfTEvVCzK85k1YCfxg0M/7OH1Ywlst+:+A/51tLEtuIjgRjict+
TLSH
T1D3D41ABA5DD215668EB223BABB1B8908E7791407100483557EDDC2A01FF2D94D2B6FFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\cef_200_percent.pak
Size 743KB
SHA256 abcb4c77d2dfcbf1a3170025b08d90ef499b19222e0cb81d1a026b7c2ec241c8
MD5 797ea647b653e8db7e9a8c0481908a8e
SHA1 db8a69016c47ccfa744c2c17e689689ea544c437
SHA512 34020411fecb2a247ca02eae5b941dee2e469204989d9efde0b815335699720f6fffad983c70a33fcdb2e15a3388f93c273376c87fdcc818eec81bd4776af6c7
SSDEEP 6144:Hw/51lxHcSgEal9Dxd0NvmxzaK1RcOsoHgs4jTl/vVCzuI7jQYVT+/ovYrbxIoIp:Q/515Ojgs4jTxtgk1/ov8BI3N3
TLSH
T147F44BBA5DD215664EB223BABB1B8908E7791807100483557EDDC2A01FF2D94D2B6FFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_extensions.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\cef_extensions.pak
Size 1.8MB
SHA256 38826127060894fd3dac9f200dba2d6c0d252f4f14d31f85df2b752cd281a483
MD5 73e1a4bcffdb0182f765d4bccaa98c5c
SHA1 457f2d052cb9f81f91984855e58e6d84579cfcf6
SHA512 3d064767febd438846e5a18c01c15ebcc4639e909a087b36aca3ea43fd83f6befba1b0b4aee7e96c422b7f597f1f1b4cbe6026ce79d4aad0d83189523c263db3
SSDEEP 49152:yIIA8V45dGH+CZHxfl4G1hdAK5JCAVitI:611h6tI
TLSH
T14A959E4E3EEA21324563B1B99F5F6245B3398017222AD4A578CCD3D81F9463842F9FF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 496KB
SHA256 376e81af629e0f742df33f0638a5ffba65d19f19e0725d0da68f2a0f3d7379cf
MD5 78910b5a3000498a4782595f499b588b
SHA1 5c13006babfcc1cd82f576b44c542e29c448338b
SHA512 98f10574c9ab86c4901327955211944da07354ecc29b97353d445d6fa4e5a69216e6a3ee7c46aca3a5b27c4a7d4cc69d0043709d5d4336c7bbcdb52a03a90211
SSDEEP 12288:otfq43qk/MSrGy2uSjvkzX6G5MmR2vf78IfBT4b:otfqoqGMfjveXqS
TLSH
T196B4AE007295C031E0A31231296CFB3E6B3CAA214B158FDFD7945D796F746D06A3AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 547B
SHA256 4275d22bb7e8273edf0bae16cf3a81d4d55324abe3379d0a9ab0813a03b978d8
MD5 66a71198485b240dc49f3d986008b685
SHA1 d47323a8a6621b3cdd8ab4e87705af2e74a824dd
SHA512 26222dd9bdd900a02b675b6dda1b3e06ed99910bb4688c77e60d03ac61832cac2a796aa96cc9513d3a540f1ccdd21c0fcb7cfcea26f24859502fa1a0358ccbc1
TLSH
T1FCF02BBF89D06979B0F11B61D02C6700BCB200991B1B800891631E5D3649F65DA685B7
MD5 SHA1 SHA512 TLSH

Submit Download

devtools_resources.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\devtools_resources.pak
Size 5.2MB
SHA256 82ddbabd12bfc5b9752e8caab1228ef41e69786ee3ff38db528e1f3257418573
MD5 eb937f38da260953471a2bc74567dc11
SHA1 6ef543bcb77260d348578fbf91f566b0ca9b7fd6
SHA512 773d64f50c01ce50b8516e483722f1e17877b2ce0a17abba5ec3bb643c84d0c7c7d508bc88b901d4d0cae9d913aa364ed52531760aab361ca88d8ac3890e19c5
SSDEEP 49152:UCq10FL1RefXWyWzm0ipjEpE1SR5LFPlAO510Fy10Fs4N10FD1Rxszq8Njlnw5fj:UCIw3fNga
TLSH
T13B464B933354003A82EA826E78BE1603BA3B5046D414D1ACF57DDDCC5BEEE429277B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Size 9.7MB
SHA256 83b3d8cecab6eea5b73263af8a4d475231f6fe4145644aa230a223e89378ab88
MD5 09e3ed722129a9ae82d4a8e0d4415858
SHA1 214cc31d4d66555ea8be4cbfda6c6a59f91f4480
SHA512 1c351847f7bbbf96304472f9e54650009aaa12fa832873a6956291536e2c1b72586970529c0c77b67ff1a142270ae6e7237aa1bf10f3df865a6cd7aec56747f2
SSDEEP 196608:7EUPty2AZwKsliXUxR0jvzl3Whl/dlrW35:L12ZmliXUxR0jvzl3Whl/dl635
TLSH
T16BA64A02B6EB4ED4FAF79F709AF023676522BD45AE31814951042F3B5C737D0A7A0B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Size 166KB
SHA256 639a224049ff333d3eb74406e8861de7051851571051dbaaebf6f5d49d1e751a
MD5 959937d96b9906988cb700f1225e1d09
SHA1 dbf29536e72127e8c673f6a6a67490424504afff
SHA512 76fba67ad342ef7bc80cf8873e5a31337606dfb7d99cc8e6a9521d3f7a547e0a662555b7576f787ce47d5318e8f4777597fbbf02270c46a1ac03b917cc736b3a
SSDEEP 3072:pi6a2li7lRhddOXgzYPV/4ClG+YM49e2TtPLzV79rfoVA5sEphAXdkw2PggluZxj:piZ7fsXHnYM49eatPLz5CVA5rw2Ij
TLSH
T113F34D0FF784122E09635262BF0962B2BF35906CA35116527CEDC12C337AB6DD2776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Size 12KB
SHA256 f854cac6dd65de2719e2ad9badcbcce3358018dfaca5bd0b3b831e1da6852cf2
MD5 4f072411d2e9d84865c3505e24a82748
SHA1 aa403c86fe4509f311ec334c0d42ed7caa3bc721
SHA512 e11ed14b4afd31d0a9f71174f15daffe51f798478e469d358052187fe2d30b145fb108981ab5737ffa460481497e4115d6f9008bd72fd8f118bcf26e45800e50
SSDEEP 384:zrGADg1ypvN1A9ozPVcmr5c+Qp/mqN1A9ozPVcmrWTduu:mAcUXTQTo
TLSH
T15642979E1A11CA38E737877F5D9F3029EE3B509C4F8266345ABF645413CA25523B3193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_blob.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\natives_blob.bin
Size 200KB
SHA256 47a86495fbc403ade14d7e451c33edb1baa810402d8d192446a7767bc563dd47
MD5 51014ed501fde761ddb4b763df687c13
SHA1 e16b402e418e948065834237defc65a788d46670
SHA512 340119877ea1befe53410afdaf9b500a674d836564d7ed5e14ea7c08596c7cdef72fdf94dad7aa87dedc0a33ca17e468f350ac5d41be408cc85303e74282d713
SSDEEP 3072:8USt9rxNpyXcsR/H/UxRjh7YL/ETfF/sBWypHE2Lyurluv:8USPrxNpyXcsRf/UxRjhuETfFD2Oui
TLSH
T1C914E967BED9AC6B42B654F8510F520EAABD8D36641894E4E08CCCD01AB710D993FF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs

Path C:\Users\Admin\AppData\Roaming\Spotify\prefs
Size 30B
SHA256 97cf1c3078084f1de0c12af9339944b03992dce29e0fdbc605ab50ce03312f6e
MD5 d647d7de70dbee39cd6ea17e6ba8fe8f
SHA1 85a26a9185a71099f54daac8f7af75a7fd439b2c
SHA512 92664b288b3bd17511760c674d92e57aa2aef4b1b6e869cbccd297a368a9dfd6f8122982e82c1a1fe810a68349efc19841fdee8c0d953a67fbdd9a9f100b2949
MD5 SHA1 SHA512

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\snapshot_blob.bin
Size 1.1MB
SHA256 1b7836d23f3a0bedc78b6f0605baa9243821ab3115a5c6c1b50e624d3f191974
MD5 c1e3108612e48592ac786bdb707e64c7
SHA1 53f25fd370b4de51efdb0c725579a92cf4fd28ff
SHA512 04aced5539f268b608fc1bb5e7dbbec48fd1c07ed145c0b79468f3e9f982509370fcf1d61672ff9da0856f7def8dfa0caeecbe66f5f63ea9fb91e810134344e2
SSDEEP 24576:Ebz90eEdYJHrjsRgWznaSxzp2/1eDipoBWySYh4wL7:g0eEdYJH8RguaSR2eDipoBW9Yh4g
TLSH
T18435E7027561C6D3C406853A8ACAD2F8E7306E215D219BA7735137FE3D3AD92DE89738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\swiftshader\libEGL.dll
Size 109KB
SHA256 319926f860f6d16ee9e8181e88f787883ed4b66ce2b29d2803bc8dfcfcdeee90
MD5 72b426f2bfc15c05c3bc8e0ee4993418
SHA1 5ccb7fe37c5dab52cb8698d62574cf80f79b9ec2
SHA512 1def49ba54ca79630ca7a734ddee59ed43e7a1decb389530eea1cc50f619bd80d300c521ed5c50976bf841b6e79475d48ff189eb428a03a69c5eb6f913f0b9b1
SSDEEP 1536:hZHlwsysteUpCWgBtSyf8F8bcqassuTsWjvVcdL/CvUZlBTFQ+YqF:hZHixstxCTBr8U7j2LaMZlBm+F
TLSH
T16AB37D01B5D0C431E4BF5A3C287893259F3E7910EEB1DE676B5805B81FB42D0AE35E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\swiftshader\libGLESv2.dll
Size 2.2MB
SHA256 4a9eaa5e4068ea634d51169876208ab9c2c40928601e3968daa685f86fba8b73
MD5 ab862793d5d54949fd01ca744c4c716a
SHA1 9e7257c830ed98e11447db0d4b2f7d9a2873b6c8
SHA512 118e4d05abbed6fd1392dd9335794d5ee95cf3dbc9d9ef23e0e7b8f27c127ae99b9494b143ce63acbd7436007804ada1e5ee6ad590925e8837f9f18bc63db312
SSDEEP 49152:0TqcsWy5GmY6JMc7OGihUGvIzfmajqGfBUQrj520W0GsGzTBeb3vR7tb757w6krU:AqRGSTj5DLw5krrYNXbTXPm
TLSH
T1BCA59F42A5A1D036F5070270383C773EBD789670586BDB4BDB959968FFE80A0362772B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Size 1.4MB
SHA256 7588a1409bcb56eaa92ed92d6f8663aabf7782f950d3fc1923649407603e12a1
MD5 196180d1433630ed250aa156e6b68ab3
SHA1 4599da3d954a6e170e755542277fd2098e8b59b0
SHA512 931453c7002b77350d86c2e0b212328a6d48bcdb4355333651ac671965c02e85e97afb094dadf3ba974c7defecd726fa37815631e344f21ff9d36aade125e29e
SSDEEP 24576:N3HHf1GPZXXpCE5+m9vd3iSSpppoZ/ZnGO39uGY/aulHBHRvR7AKwN:hf1GPZnpCE5+wd3Upppo7JuGYCulHBHa
TLSH
T1356548623261C6C3C505863998CA93E47B312D21AD169797F2D23F7E2B765D28D8CB3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2208-238-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/3188-211-0x0000000005680000-0x0000000005681000-memory.dmp

Download

memory/3188-210-0x0000000005740000-0x0000000005741000-memory.dmp

Download

memory/3188-209-0x0000000005780000-0x0000000005782000-memory.dmp

Download

memory/3188-155-0x0000000005660000-0x0000000005661000-memory.dmp

Download

memory/3188-147-0x0000000005690000-0x0000000005691000-memory.dmp

Download

memory/3188-180-0x00000000055C0000-0x00000000055C1000-memory.dmp

Download

memory/3188-179-0x00000000056C0000-0x00000000056C1000-memory.dmp

Download

memory/3188-184-0x0000000005640000-0x0000000005641000-memory.dmp

Download

memory/3188-183-0x00000000056D0000-0x00000000056D1000-memory.dmp

Download

memory/3188-182-0x00000000056F0000-0x00000000056F1000-memory.dmp

Download

memory/3188-275-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/3188-138-0x00000000055D0000-0x00000000055D2000-memory.dmp

Download

memory/3188-139-0x00000000055F0000-0x00000000055F1000-memory.dmp

Download

memory/3188-188-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/3188-193-0x0000000005730000-0x0000000005731000-memory.dmp

Download

memory/3188-195-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3188-264-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/3188-140-0x0000000005670000-0x0000000005671000-memory.dmp

Download

memory/3188-137-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/3188-212-0x0000000005750000-0x0000000005751000-memory.dmp

Download

memory/3188-154-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/3188-143-0x0000000005610000-0x0000000005611000-memory.dmp

Download

memory/3188-156-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/3188-213-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/3188-141-0x0000000005620000-0x0000000005621000-memory.dmp

Download

memory/3188-144-0x0000000005630000-0x0000000005631000-memory.dmp

Download

memory/3188-145-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/3188-168-0x0000000005650000-0x0000000005651000-memory.dmp

Download

memory/3188-142-0x0000000005590000-0x0000000005591000-memory.dmp

Download

memory/3188-169-0x00000000055A0000-0x00000000055A1000-memory.dmp

Download

memory/4268-208-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/4268-263-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/4268-265-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/4268-266-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/5068-250-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/5068-157-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/5068-194-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/5068-276-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/5196-260-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/5196-261-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/5196-273-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

memory/5196-181-0x0000000000400000-0x0000000001A1B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads