a223876a91f76c5b40cfbcdff188ecfa68901c57548b88773c5489673b642a5b

Analysis

max time kernel
54s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
Size 1.6MB
Sample260522-2aezbafv7m
SHA256 a223876a91f76c5b40cfbcdff188ecfa68901c57548b88773c5489673b642a5b
MD5 bd26b33bf12d3cad681c8124ac6976ff
SHA1 3e7074efbf3cfeca1b289c77f5cf6ce179b5aa50
SHA512 96e883c246a031cf869143dcd0ea7c82476de634a557d5e0154427302b1d8208f6b80acac981f1b59ace6d3a8f29ae24d91f13cb21757a0be2cbfcf382a870e6
SSDEEP 12288:5FUNDaImwW6APE/Xu2uA31/QnWpOL0WlBYLMlUYtwnd8LgST66B7DTSFi14jY:5FOaDCoE/huA3ynWp00WjYQuvY
TLSH
T142756D495B64D97EF363D17D5055E23DEA323C220FC2924602EA52FC1AB732475AFB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 9 IoCs

pid	Process
5024	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
6044	icsys.icn.exe
5084	explorer.exe
4352	spoolsv.exe
3096	svchost.exe
3420	spoolsv.exe
4524	SpWebInst0.exe
4720	Spotify.exe
2940	Spotify.exe

Loads dropped DLL 2 IoCs

pid	Process
4720	Spotify.exe
2940	Spotify.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2248	Spotify.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\AppUserModelId	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\AppUserModelId\Spotify.desktop.client\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\AppUserModelId\Spotify.desktop.client\DisplayName = "Spotify"	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\AppUserModelId\Spotify.desktop.launcher	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\AppUserModelId\Spotify.desktop.launcher\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\AppUserModelId\Spotify.desktop.launcher\DisplayName = "Spotify Launcher"	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\AppUserModelId\Spotify.desktop.client	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\AppUserModelId\Spotify.desktop.client\CustomActivator = "{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\AppUserModelId\Spotify.desktop.launcher\CustomActivator = "{18A68F64-72DD-42CE-A75D-EDBDAC226F5D}"	SpWebInst0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5084	explorer.exe
3096	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
6044	icsys.icn.exe
6044	icsys.icn.exe
5084	explorer.exe
5084	explorer.exe
4352	spoolsv.exe
4352	spoolsv.exe
3096	svchost.exe
3096	svchost.exe
3420	spoolsv.exe
3420	spoolsv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 5024	1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe	80
PID 1104 wrote to memory of 6044	1104	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe	81
PID 6044 wrote to memory of 5084	6044	icsys.icn.exe	82
PID 5084 wrote to memory of 4352	5084	explorer.exe	83
PID 4352 wrote to memory of 3096	4352	spoolsv.exe	84
PID 3096 wrote to memory of 3420	3096	svchost.exe	85
PID 5024 wrote to memory of 4524	5024	2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe	88
PID 4524 wrote to memory of 4720	4524	SpWebInst0.exe	89
PID 4720 wrote to memory of 2940	4720	Spotify.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- \??\c:\users\admin\appdata\local\temp\2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
  c:\users\admin\appdata\local\temp\2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
    SpWebInst0.exe /webinstall
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      Spotify.exe /INSTALLCOMPLETE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.90.451 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ffcef285448,0x7ffcef285454,0x7ffcef285460
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2940
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2108,i,13897115652268697495,3232461927119589989,262144 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2376 --mojo-platform-channel-handle=2364 /prefetch:2
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=2436,i,13068098428290700705,5428960174891596143,524288 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2536 --mojo-platform-channel-handle=2532 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2248
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=2880,i,593613087638332398,18249164591344654834,524288 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=3100 --mojo-platform-channel-handle=3092 /prefetch:13
        5⤵
        
        PID:1028
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=5816,i,2123057435119339229,14589474011022482309,2097152 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=5856 --mojo-platform-channel-handle=5852 /prefetch:1
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7260,i,5113538246400383329,8225114978236287620,524288 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7644 --mojo-platform-channel-handle=7640 /prefetch:14
        5⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7752,i,5821234726761150687,9299440504935980787,524288 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=7756 --mojo-platform-channel-handle=3660 /prefetch:14
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7928,i,8459329746095295699,16220521767806114924,524288 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=7752 --mojo-platform-channel-handle=3676 /prefetch:14
        5⤵
        
        PID:1560
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7764,i,11752139571329265921,6216783268903622542,524288 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708995682289984 --enable-logging=handle --log-file=7908 --mojo-platform-channel-handle=7780 /prefetch:14
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=3784,i,3671866389026565466,18329965413966286783,524288 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=7748 --mojo-platform-channel-handle=7792 /prefetch:14
        5⤵
        
        PID:1192
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7708,i,15318511234777425636,9131619376269645554,524288 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708997556373682 --enable-logging=handle --log-file=7804 --mojo-platform-channel-handle=7808 /prefetch:14
        5⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7712,i,12198960118772788033,7761946503407783577,524288 --field-trial-handle=2368,i,12551864062549666056,6592862989082942771,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2372,i,16720137725569799741,6970853155481564753,4 --trace-process-track-uuid=3190708998493415531 --enable-logging=handle --log-file=7696 --mojo-platform-channel-handle=7260 /prefetch:14
        5⤵
        
        PID:2972
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6044
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4352
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3096
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5804

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
1⤵
PID:3500
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.90.451 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ffcef285448,0x7ffcef285454,0x7ffcef285460
  2⤵
  PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

heuristic_regexes.binarypb

Path C:\Users\Admin\AppData\Local\Spotify\AmountExtractionHeuristicRegexes\4\heuristic_regexes.binarypb
Size 633B
SHA256 a10f65d7e0d56702d6f08850c8bee9bd51af17f4be051900ff2b88c9217e425f
MD5 f1f50fc7b156489a7f5ea400bdf4e360
SHA1 b7a57e1afc583451e4e21e27e25cb2e306e6bed0
SHA512 85fa5bd86a3e478b50a642fce45e6da4137898bcdb320e5469c8bc419402ea5eaa952a41b171a478ac9ecd38f58510576ce35d1847ed89bca8bf10c5d483fc17
TLSH
T10CF0ACE23A11B4089B2C1FEF6B8474665FAE8C87014DD455E1CB905BF4966BC6F17404
MD5 SHA1 SHA512 TLSH

Submit Download

9de5148f-df81-488c-9629-7528e3ca78de.tmp

Path C:\Users\Admin\AppData\Local\Spotify\Browser\9de5148f-df81-488c-9629-7528e3ca78de.tmp
Size 10KB
SHA256 61de9d9fa225774e52e97f1e3c1a389b8446101c3b7804d36864394faf07ebea
MD5 a3d820d0d31c1119c1c38298d75363df
SHA1 a1845ab16ad0204348eea0ced707f29ebd72b73b
SHA512 bde5050d21f7e842b06f24f52f783cebe0f3983957125e928a244a877c4293252c00795dbd536b651be3a69eeb77228027eac01543dd858d3eace715184be470
SSDEEP 192:zRgwsZdnI2v7f4z9CHcb+WNVSRSydSBNacZSD/yIsn2Kgw:zRudla8gsXhw
TLSH
T1EF22945BAA34597B5CCBD22AF964B762E3F50031B5A06D54D6FC8A2C18D76CC2227C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5ca529bb7c68fac67ec39b8e662a4a8e0b643609e6056d86a06ee4876c0083a2
MD5 cef90a399a4d7cb57decd356c74342de
SHA1 79edbc8a58d951498e18d41ad01147c10f5775ad
SHA512 ccfa0ed75a30b69eb813cd8c79101048bb26aea0debf7d2cceac730d89e68bf6ded7e6fef6574528818c41fee635f17709a8beae17c0992c9a5c20768f887653
TLSH
T1FAA002700943407BC24076792151B7613221D95541D29B0BDAF30D98CDD5EC94251084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592f34.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe592f34.TMP
Size 48B
SHA256 febb1498f7b4d1e914e48466e2960d6decd763b35b9f436e1cfb435abbceabae
MD5 ef34324cfacd88e6eacde6d429f4c40e
SHA1 ac309b35803844d6fe8bcd23957db1435afd6c29
SHA512 1db18b19e4562eeb41fac27ff59c24358e5a32bf46bc81e42cd96a414999e23a284c6707fd347f043652ce39003bea75bd2a4b2b04e5a1863bba50f651d3a9fe
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
Size 2KB
SHA256 00c79a19638132e973335f509d6637a7a64f7f0cea7bf82442354079822c96e9
MD5 ad6ab4d62893fbe30536ecd06bb78e5a
SHA1 d69df448fa8ccf165f8b40a2b508f7e80602e2c6
SHA512 c117b48272ffb4875c2fac693e7912b40e2dbdbf3504eeb99c0f6031d7fa6a754a671dfbbc26b8ddb853c19493daf26d0f2549caf97c0d63896159b741a3e6ce
TLSH
T174419FA3C2D9962DC94112F4AB183E1BCE3D0A1493783D27C9E5BF0FA3D1571E20055E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
Size 10KB
SHA256 7e632fc87876c211ffcf8106814edcfdf56ff805d67a5dd26f5422cf1e9b989d
MD5 13a7f400194a5ed35edf7fe0b3436e21
SHA1 35fcb18d4493ac614a34d47b06d1b34c158e3be1
SHA512 b86a0a2c67928a6ebb0e0e19b7cd76c5ef6a00ff5476b4d8ba8e603a17fca79f80c8d3ba67e38443e83ab4e0aba13f115300b1b0739f96c449baa934122c81b5
SSDEEP 192:zRgwsZdnI2v7fBz9CHcb+WNVSRSydSBNaqZ0D/yIsn2Kgu:zRudlR8gsFhu
TLSH
T1ED32A55BA934597B9CCBD22AF964B762E3F50031B5A02D54D7FC8E1C19D76CC212780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5925af.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe5925af.TMP
Size 10KB
SHA256 daf535b67978cb9424b62fac7cb964bb50b52b193e740b083e8c8b27bb801b54
MD5 874a730cbc60e31fc695efe55f87381f
SHA1 d80744295b2890804fd409f3804769047b9328ad
SHA512 ff39fcab95bd8fec48c6d1546c252fe652dd3c7daede4ccb49ac0ee716fda5ddaad9ae5aa4ae0a260ad3da2c1c178021d673871f9c82e019562f501963366183
SSDEEP 192:zRgwsZdnIbv7S4z9CHcb+WNVSRSydSBNacZSD/yIsn2Kgw:zRudoz8gsXhw
TLSH
T1C122A41BAA34597B5CCBD22AF964B762E3F50031B5A06D54D6FC8E2C18D76CC2227C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preload Data

Path C:\Users\Admin\AppData\Local\Spotify\Crowd Deny\2026.5.18.61\Preload Data
Size 236KB
SHA256 0c96835e7c1f00209f24940906681de12fc540474c22297fdad9cad82d52cffa
MD5 72481896c35ad5225886d2020e28ec44
SHA1 6b0db8ae60b550420d105e1f9664fde777219cd9
SHA512 26b726c8e3a5dae09ee676353d8a9bc0ea86701d3b34824b101d066c51561d66d0b3cf99000e0f39c3def21c90ab31ef68de6b04f9b4095b25e4f3be45e77170
SSDEEP 6144:c+soi1i38yHxdGuaZD5/iTWI6TAijLGrlFjhZ:9IW8Lk6khZ
TLSH
T177342E41C9393167EFDA573EA8B51A1C2BA4ED20336CF4DD8418529A39FF3D412B8D86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9188da3d-4e6d-464e-bcd9-5ad98fe15afa.tmp

Path C:\Users\Admin\AppData\Local\Spotify\Default\9188da3d-4e6d-464e-bcd9-5ad98fe15afa.tmp
Size 8KB
SHA256 1d4c4b33914ff43f50245b70560520f4c7c5497e49488bde4f7858676320291c
MD5 796a890e15925cdff31ea5dae52e6cc5
SHA1 70f39d7f867c6b5e4641a95863fe84e67c06ad34
SHA512 967a6367665fd6757c48576a6ad51cdadc88ab15121ee59850924c1326bc075d5de96d790870f9e9a146303c434ef11ca31f4579e73d1d2bbf93b1480da2aded
SSDEEP 192:zRvwv5YCv7aI295Hcb+WNOoF/yIsn2Kgj:zRe5H87gzj
TLSH
T12702A52AAD245A7F9CD6E75AF9257B41E3F5102175903D08D7FCCA2C28D7ACC122781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Spotify\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
Size 922B
SHA256 0c4fd762250b3b4dcc6a9220c6d4a231407079e11f478cb3f74bee295d09ba8d
MD5 b6b466e1af2cf20bd7c7f7b0dd4e357c
SHA1 aadf81302aa0e8353880aa75f1c40f277b7999af
SHA512 7ac65bd471eefb1386029393deae86a5fda18e7bf4fe750e4dc081faf4428fbf9641bf0090c02bf4c59e2a12b1b5bc3ccdca51aa4cf9f40b83a14338cf2d6f72
TLSH
T1FC119CF7C3E5852E8A4102F4AB147F1FCE290604436C382788E4BF1B93E2872E11065F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
Size 8KB
SHA256 460283b2b1371cd6a077a926acdb1a69c1317aa4b8902796bcf446d88641c434
MD5 2e2867aa3e5c970b1385b9152a026ba4
SHA1 4f5b571c00af7aa2c1b4b693c4ae0e025a601f42
SHA512 4f04f5da9cb5d8c2f5c5c705009889987d6c9a058027cbbd5add77024fd171c20fa736002b54b1ded6e82b872e9eeb568c285840b1bdcef64b8b8f7d8bacf98d
SSDEEP 192:zRvwv5YCv7at295Hcb+WNOkx/yIsn2Kgj:zRe5H97gPj
TLSH
T10112B31BAD205A7B9CD6E75AF9657B81E3F5103175902D08D7FCCA2C28E7ACC122741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Spotify\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

download_file_types.pb

Path C:\Users\Admin\AppData\Local\Spotify\FileTypePolicies\145.0.7584.0\download_file_types.pb
Size 7KB
SHA256 a1391aa8d42be124bd50c493886fe7b3a709059ee20b0e012b421390f4a3864e
MD5 7dc81804b51ea4b37bd595b44c7e087c
SHA1 88fa328e93247b5d8d8aaca3d83bd8a803bf1c28
SHA512 8028fda2f5fcf3b7b23d09bb0a35f6e885417b10bf4512aac1d109d4ab355804c9f092f765c3017b87d120c7d00d4dbe8e628ccc8b15b807089e2b9b1b741f3a
SSDEEP 192:e0aEW8SsWk/pvtHB3Nf5Y10k6QKEa4pmifL1YbAnz1BRsO1v:e0aEW8SsWk/pvtHB3Nf5YKk6QKEa4pmu
TLSH
T1E7F1E9C5893A19E83C31D391F1B9C120CD15EDAB9C6F248E8BB3529B7BC1D868E27157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 3KB
SHA256 8b9563615a8fb8ffab9ce7bc4f2b14e2cd28054e7ef893036fe0e899f9d98c3b
MD5 23c37d85cffa89d8fc2fa28e801feacb
SHA1 6561b3911a0394553d1b70dc012b607b68a114a8
SHA512 8e1c48b71b0f0cba9a3e8f4ef63e924b6fbc21691353c2a03044bb4b20831f746e52ac6fad56b553a3cd84fa0cf77c6e49e193aeb06a66f9b8c88e8d59e6d6be
TLSH
T10B61862665B58D7798BBD485B9463B03ABA42127E2907AD8E5FD4F0C11EB5DC0343817
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 6KB
SHA256 9b877043df3c998433839c1eb4932003aace6c61e0941d16bc98ce0a6afc8539
MD5 522533005d72c7218b2c619173283271
SHA1 5ba72b97454d8d542150d78aae77942a4170bd78
SHA512 e2cf9b38673813ce49b337cf2603417583ce00c28253e1a9920794391ba202d0a1ca585c951ecd5bb836f94e1d58b848472dc223ebcb1164cc030c87e3932828
SSDEEP 96:PtbJ6zLPfSK6Ba+Dotoh+DotoyN5K9DtB6ZGyvJgh/U12/wQDsDgM2wea:Ft/KuDUxDUBsz9NVfMH
TLSH
T128D1862BE696CEA7E8FFB681265176C7EF5852195181DAD4CCD90D0C04EF5EC220782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 6KB
SHA256 c1a3967f05acb9e32038e168097338a714174014efdf7fb2503a8c020964c5ce
MD5 9344c8e847e1372322728381154b7a2f
SHA1 039f5319fa106386b79959f43abc8e1f714ca632
SHA512 2ecab3bff40da6419874032658325fac3702213f77d65c2afb27a8ad6882f9151a48043fb1c2400f009c274ce3c232cac39b8c63e7ae60ac59febd373b1e0beb
SSDEEP 96:PtbJ6zLPfSK6Ba+Dotoh+DotoyN5K9DtB6ZGyvBgh/U12/zQDsDgM2wea:Ft/KuDUxDUBsz9fV8MH
TLSH
T172E1A63BE696CEE7E8FFB691261176C6EF5892195181DAD4CCD90D0C04EF5EC220782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58e402.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe58e402.TMP
Size 1008B
SHA256 acf86eedd0227b167f147b068b89e9d493803defcbc78c6b7b77d9feffd15387
MD5 f98d1c1657e944182cd6bd5cfc9353ee
SHA1 c9aa1bd9c5af7e685cb3a836f2afdf263f5aa795
SHA512 b300b3fa5752559e17e01ca59cb2e507c38fbc93c58dde7a366f2656fd91461c0693d8427af22c73ecf3119afe3425feb941286b3293716acc7ce4796aea634a
TLSH
T1331161B3A9109F71ECE559AA738A7B431F2151B2C282168932EF171612BB5980303C30
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Spotify\PrivacySandboxAttestationsPreloaded\2025.6.16.0\manifest.json
Size 97B
SHA256 335b1566f2a398f764be95e60ea16352e087262dfffa2616576bb22947d7e4bc
MD5 bb2720cb7fa3a5c821be80f5b421e090
SHA1 c969483a66c882a2d99cd35a99954c64e4ccf373
SHA512 b2f326381ec8904a4d193b2dc7c624318c76cf23ac464a03a3f0528dbba54520ae0fce4fc7b914ac2ed7ed380d3616459b7a5754b9748b45507ead051b910739
TLSH
T148B012B56844B27714C403240B328392ABF15D4238237D30150610802164139026726D
MD5 SHA1 SHA512 TLSH

Submit Download

privacy-sandbox-attestations.dat

Path C:\Users\Admin\AppData\Local\Spotify\PrivacySandboxAttestationsPreloaded\2025.6.16.0\privacy-sandbox-attestations.dat
Size 7KB
SHA256 d5fbb03c2733c6670d21968bd057f315d56640f4e9dc3333f60e0b81fe3920d9
MD5 7e4a457babea8ae2a1bc06c33fc769db
SHA1 abe16daf9d7610f19042daaae3a5ba60100f3ed0
SHA512 f4072490ae4a0697a9e64ec7b8b9a9d3c182f03cc61be76c9ea5b20199f197f0ddd6c772485822c5a68e75958bee63bac529e18095eb0d861425255951e23e97
SSDEEP 192:I+0f6YueVE96ihN65bUgscC3Jl51qiUNUYUBWGupiYlgTVx1yD2Am:R0f6Yud4c65QgXOT1qXNUYYGpLgTf1hn
TLSH
T128F155FF213061144F5101C7B657BACFEA57421C8EEECAE9C7A0D5A622C12B5A9C3399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Size 56B
SHA256 c143ccfd077064aebd62b73cdcfa85dd27b31c0f168ddb9651eac8c1cc95cf4c
MD5 d03705fd8d19d9830fc7d1585b56efdc
SHA1 625ecd18f540c295cca4c225ec4323bc482ba1dd
SHA512 f976bafdf84c64986ffe05dc0697eaf532d4caf2f9767fa5c75d8e2d626b2337a98c31df445acd53d5493a2256a3a23658ca86fe68759dddd1b431a0a24aa6f1
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
Size 124B
SHA256 418e37a64c865013c87c6d30e5094d292fa74fb46e449d968ac83f492e46407b
MD5 65978328b8ddedd4a287abe5830f4bf7
SHA1 9bc9c6b04f3ec217420c3b4c0144f0cac646f106
SHA512 ccc0af038181bff44ec356fdc1a43a3a97fabf3aa55411bb08368ec95c3830229a7f5d7c23e85f55a3ddc7ad078de3ee2418fafa64d6dc92464892ccbab119bd
TLSH
T17CB09BCC05DD81B46E05867E517D1C57D6467F015464159555576511353834F0052157
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
Size 348B
SHA256 b0210740f8397519be623198721ab9dd50d378807a453c0f54416f447150534c
MD5 0fd7bc69f962741037f130041651078e
SHA1 f358d34b13148ad233b53982b44e21d40ec31344
SHA512 3d4a7c67ddb27c3def961e63835f794048a64d1430b804d984629df860c32b442fd556569ea65cb9744c0c427ecdd597b7f8f627910152656d25fa1fd4338c2c
TLSH
T198E0C6DAC88EC2A80F01E77E22FE285BC282AF02E120227768073E4020A430F310243F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
Size 236B
SHA256 653c0000dfffdcb13f1d9bb992da0788548adeda578f63bd99ec664461d5c469
MD5 8c4ffff847944bfbe93579efa773b7c7
SHA1 008ccc13e69d1e001df94f62e02ea04a9a4d8ae5
SHA512 786d7839eb3507c0c8340f21996f1c0ab1aca374ebc24e9c2a85e762d086161d9cf44637c0ef696ecf0b9e35c213c6ece8d6d6eca8f9696f190209822f4eaa26
TLSH
T14AD0A7CC859DC6986F06D66E52FE2C4BC143EF46A06421B7A8076590257834F244542B
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
Size 460B
SHA256 3842d6d59acd24aea986a9af9d2dd61d5804ef2950d22ef9b978eabe014ce5f3
MD5 c1f8d673705a8992700ec65ff2fb0fd9
SHA1 80906c87b1012282fe7e93993c13a70036220147
SHA512 76f3c4f7e9cc5d764294a46f6e0bbfc82d2f961f6b7aeb2633203887183f33d440c662b9d4b6956ceecfabb6009e7646ed543117bf2b0d0d334e91eccb786fda
TLSH
T1E9F0DCDB88CD86880A019B3E61FE682BC152AF02EA60323B54173E0416B039F211182E
MD5 SHA1 SHA512 TLSH

Submit Download

a63e962f-fc49-4cd3-87cb-37b5cd8bee04.tmp

Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\a63e962f-fc49-4cd3-87cb-37b5cd8bee04.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
Size 3.8MB
SHA256 72f7f40d5a65a0074c2745ca485a609e835f8abf2429c8dbd795174bac5c0bd6
MD5 31910ada08effc8e9ee366c4db26d08d
SHA1 ac685430e3e681d772dc4db21b580700c77b310a
SHA512 4c590e9e12fe62c6e9f197ae94bbaaf80be9898a1d8aa49bcc01fec99c77c263a237149a81962b5c046b299c6d7c6992efdc22563a9f646e411fe2b74d893950
SSDEEP 98304:9MdzuuBDHase9hrpqwtURsjmiYBOAnHJbXS9aECsq0xZMxdt2:suajK9XJLjwHJb4aECK3MY
TLSH
T1651633B843B50941D6BD1A38CAED9B27E7521ED20651FFA5B824C3F21A4B5CB8CF1136
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 39.5MB
SHA256 1410132f753656fbdb18ad9fb7f94565000c85704b3f4db48c1ab705d367ea7b
MD5 7fa5d3295dff145525f3194e2c73eafa
SHA1 7a3bb110cbf27dd12aac0be8921f46e2e4d42076
SHA512 28190b294e08b2fce7574584b791371b0351a32744cb28bd8be4bdc9ce792c5cea08dc25ca01d3972bd13cfb7dd235f3f11f5cc32a53fd8ea0e5a86441b35a5c
SSDEEP 393216:ig48QZPeN5RIgkAQnnKMwjT8LLa7kMFeCxhg7usy3IC5://RIgEBe/vgNy3IC5
TLSH
T1F8979DAB71E401ECC0AAE1BACA17DD17EBB7744A0331E34F01A182635F67A60567F761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 33.0MB
SHA256 3d56b189f3e39deb658a33591bbeda6f289fb737deff88968c228ff52025afb0
MD5 ecb288f0181cb1b667256f8748bde75a
SHA1 a8eeb223121b4f1c077ccf001e6bfb1e5e6e88a8
SHA512 c70e232e7afd626490394ad3c43ec839f105f7847a1324b4d5c5f30c540b1972c53ef76da4afd9b8d2023fb334306a02d4d599ef30791d179823613545393cbe
SSDEEP 196608:iwJ4bpe1P4/hPUnNu3UVm4zHCA72mi6x3bIgytqIieZRAQnnKMwjoquvuyo0D26k:ig48QZPeN5RIgkAQnnKMwjT8LLa7kMX
TLSH
T101777CAB71E401ECC0AEE1B6CB17DD17EBB3744A0731A24F01A086635F67A60567F762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 28.5MB
SHA256 33f0d4de22b02bb58ef7ecf659f909c41c914291ab90c6059b23e5854635eeba
MD5 104c662e1ad14b6d8d5ea19e0ca19f56
SHA1 111e101f80c191044073d0cb658ed7f2fc5c2a20
SHA512 9d0d6e303ff9d3cf8cf56e5e9d609c5caae3df18f643b95e80c356d3f31228f80261fa0f6153d350c89b44dac593ac65638f2506b4c849e23cb231244f37984e
SSDEEP 196608:iwJ4bpe1P4/hPUnNu3UVm4zHCA72mi6x3bIgytqIieZRAQnnKMwjoquvuyo0D26t:ig48QZPeN5RIgkAQnnKMwjT8LLa7kx
TLSH
T168676C6A62B400ECD0FAE1B5CF179D17DBB2744A0771E24F06E186A35F67A20467F362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 29.4MB
SHA256 0b5dba112a560c53fd373a394c7d33e64e49c01c66910df8c936989ae2afe6d4
MD5 13418128661c67f02258e7aefc258b1d
SHA1 4bea193eeddc7f9b45fabd5a2a7a3ddcae3ef50b
SHA512 f6a8a6180129f7ffad58b43bfb9202e374153d221df182717de2f92f79903d9468fefa3c5053df2ab84ccf0612c4c57852932b42b521e47a3e668150e2b69087
SSDEEP 196608:iwJ4bpe1P4/hPUnNu3UVm4zHCA72mi6x3bIgytqIieZRAQnnKMwjoquvuyo0D26c:ig48QZPeN5RIgkAQnnKMwjT8LLa7kQ
TLSH
T1F4676B6A62B400ECD0FED1B6CE178D17EBB2744A4371E24F06E186A35F67660467F362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 29.4MB
SHA256 f657af0eb0e90c7ace07bc430f876ba7aeca87ba764b430717974cf4fc6aef05
MD5 13c3a2e7752dbd8fd503cbb0f0c6fdf9
SHA1 79432269ce98921cfcde616139a75ddffc149219
SHA512 0a117129c529a6f70168a18058c3aca3803eb893e704ed97cc0e0ddb2843d2438dbb1dacecbe0370d34b3af49bc5a2a536bae59b4f5d86ff53f965f708c9f357
SSDEEP 196608:iwJ4bpe1P4/hPUnNu3UVm4zHCA72mi6x3bIgytqIieZRAQnnKMwjoquvuyo0D26H:ig48QZPeN5RIgkAQnnKMwjT8LLa7kD
TLSH
T128676B6A62B400ECD0FED1B6CE178D17EBB2744A4371E24F06E186A35F67660467F362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 28.4MB
SHA256 265c6d95f7f0d2fd58f6adf0b00c4009935a4a0ecc972452adc347b9452acec2
MD5 cc137bca1452bdd3d0a3248f23953339
SHA1 e9afff0c4d11de4e0e652c49cc6f4060798be9a3
SHA512 820dcf9ae83fbaebf48cbb856c0eb0eb43229ac7006822a67e0abdab759fc4479996b1b50e2ffbc148091ee22cb1bad0c61283526731934648277463b862ade5
SSDEEP 196608:iwJ4bpe1P4/hPUnNu3UVm4zHCA72mi6x3bIgytqIieZRAQnnKMwjoquvuyo0D26O:ig48QZPeN5RIgkAQnnKMwjT8LLa7ki
TLSH
T131676C6A62B400ECD0FAE1B5CF179D17DBB2744A0771E24F06E186A35F67A20467F362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 305e8f96a7bfb83f600d4f4dec4d169ab9dd4d5cb7b77b2e1da28cfbe2d58cc6
MD5 b6c8b31b18ebbaf2e7ba98fe862d578d
SHA1 b73cac27b474454d5a1564f4d839a8328d7b4eee
SHA512 4643669f5a8541e9383070c3f150cea30fd6f4e60d8bb0e6e06e593b8160380db9bc7516a1891fe3f71d7e5cda538015cf43359c7091f4f540ad7ca3037c94d8
SSDEEP 49152:OHYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+diJ:OHYg8xwfGrUA9Ncnas8jds
TLSH
T1FFD57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Size 705KB
SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
MD5 0321d6c44a6041910208ce3891727842
SHA1 42e8935bd94f0fa3fd8611fc84e25a06e8ba82ed
SHA512 6c9348ed4d50fb2503012b80c0dc8f4cf07d00d2ff857fff8c102266533e65befc6535998f9497fe414cd427dfaf0ff3e5cd1b586addba236b3794768e3d476c
SSDEEP 12288:bI3H1fJwhjzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnSzm5dVYJblIt6kjKQCrC:U3VBE7zEEmPL8bTe+gnSzm5d2bc6kGQt
TLSH
T1FCE412E77374AC7DEE9B1277826505B0FC371A681B82020A179BF8796913B48D8C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Size 1.2MB
SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
MD5 d995543b367f8675ba74b90f42790175
SHA1 ae7f07096d74d1565929fffbf1a9711a08fc74e1
SHA512 99018c2cd0685bcfc6de8d08a649515b606982f56f1dced3b5304c7358e74bb463aa89795752580abff98b288865b49720940f8f0707a5f2527457edda968685
SSDEEP 24576:i3zB09p2zLmmibkFR8+mZi5r8BWhQumeMRvQt93dyQwuSXAkpbaUGQ74:i3y23mNbkFRJmQ58khQRT1QPtauSXAkA
TLSH
T19E4522D7A370DC7DDD530BB7929B40F4FD7A106B0AB2140A0627BD7A39257889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 9eaf3adaf1ef4a7f0639e6e2b1855bfe2125271342faeb2eac40d2039e84d8d1
MD5 81f57562cdde75922c8d06eb5ecf71d6
SHA1 157f91b5ea6ec3d29abb079f4446c21f528d162a
SHA512 f80c7bab7dd206098e4ba13b275d06f793f53cdbbd765ba633a88561705c6d0fc5a3d4c656304f648c3e20a88421a8c2d3a67b46bc9a6793194455390bae2add
SSDEEP 49152:eLOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l1r:eqG2qe6JBKDtXmKjr
TLSH
T160C56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 632B
SHA256 edc24259c1f3013abdb8c6262b5c8aa9d3656ba38e515f88cc797bf5b9456b31
MD5 5aaf16fc582736ea5c9ec3dfc936f5d5
SHA1 2e467feb86e8f6414f0acbdc2a3dcec9573dd026
SHA512 b21919cf3bbe7b69d98f8b3ce46a7aa9e9b292404cbee07818d9456b5fd069c6a63f8ac61cd8d1ee5369245aea9deaa988967fa5bd8164b1eb7f549e21e928f8
TLSH
T1A8F02DFF59D0657A90F10BA1D03C63107CB205951B2B805846531F993B48F69CE5DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
Size 4.5MB
SHA256 68ff9808c208eef52df74895a29ce184335a6332aad3cebbd64f6111805bc745
MD5 d5b0b6792663a414f502950439a02be3
SHA1 247c5744d114b39afa484cf4c4aa5188bfb0a05c
SHA512 f1039886c49231b38106aca2ce465ebb0a3307976bcc0b627a48a1c9940f8c7dfdf5a6da18350a8fe7d3ce0bc8c4d79918d386036707b3217e5e89b95cdb9545
SSDEEP 49152:RSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqc:UuktcrfNlTyj5byqSD
TLSH
T11F268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
Size 504KB
SHA256 3f7027612c5f2b472fb725f2869666ad2a5e9e4e0d7c8c0d82c21450741ccc11
MD5 68109aa9c86938b14360048be698011b
SHA1 3b54416dd1bd70ca97655d0ac5f5a1c06f2a0eff
SHA512 d4179ab1bdc595d59600538ff874d26de4dd5c2db362a718847fcd2bc0c06013c467b0d90756cc61654f8c458da5cefb530ecb64e5aaf41c16b952803889fd39
SSDEEP 6144:jF1o4DAf5s1KStUkNbhk7Ak7KhPCcgoF0NKzdgbsQr7rVGCXoxV:51o405CtUkBZk7K9CcgG0NWd/QDVGtV
TLSH
T165B48E15B3E94AACE07AC134CA438547EB7178460B61F6DF02E0A2792F77BE45B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
Size 7.5MB
SHA256 63aca2cc923b97b55dfc47146cae1cc3abf744c204ac4305ef3acc53704af8ec
MD5 e293cc0ccbbf9ad95cf57427c875052c
SHA1 792c20f90f55966eb6092cd2b2b3232ab580aed8
SHA512 f6ef2cbca21596b527d26b5555958d96903c0bf9eec84f9f1aa7d22cef9e4824df77a43f49f31cfc7ef8730e7452517230d9390ce098785995a7f09602580d1a
SSDEEP 49152:StvLjzlN4kFextqcusm4nHcpOjwrMQOT6n1SSCOQESgswJYgZc+5GTSpWy4EWT53:cWusNpjgKle2S+E8Nkpp0ve9fPzFk
TLSH
T18C867C13F69240DDC01DE2B8975B9223F778B8450764B2CF2A5453162FBAFE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Size 577KB
SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
MD5 2a1964ff31c7edff17f4c74d26fce378
SHA1 2c66f52ac23828ec6a18a6720ebfcb275482edcb
SHA512 fbb19f906ab8f61461c8be80d53a7cadddfe81524918171c0bfab45f9cec2f5c045ff7ff864858f5c087d4b05c585ba58dfdb7565302605efc524f388c241ba0
SSDEEP 6144:WpcHQYHQbmpKwey1WMmHfYOMg/jSxMP9sQqblfaYQhp1BPOjnng98//gwb:wwQKAGMDHfdgM6Qqbgaj+wb
TLSH
T117C42B1FF744122A05A352A27F099562FF32D06CA35112663CBD812C3376B6693BB7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Size 16KB
SHA256 aa146c3fbb7af8381836b0c7c2569a13c1494c26994b996f94cebf272b59fa9d
MD5 2902d16e28d992fb04c980fac5a2e1ef
SHA1 7d9ed920e7ede5a4d17c09ad18fa236a5795a369
SHA512 c4d2a70684421a362bd7429a0ca1e150e0f46d32da4c84cdb3d9533be540244f7f12ea7a8737f8c8b8ea8577464f8d42a772db94b2febc1fdbd7c67a606830d9
SSDEEP 384:OnrjoRA5/F6qA9oz+EFRUeLq4+lLbK2lc+Qp/AOqA9oz+EFRUeLq4+lLbK2VTdu/:ejcXXsXXO
TLSH
T1B772C79F1A21CA38E637477F6A9E3525EB3B805C4F8195341AFBA04823C635613F71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-Hant.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
Size 16KB
SHA256 df81711e5812dbd894e74e1904006138c4358659b5175899df0bb9db10e57bb1
MD5 b1ead1acd8980b34347ae9a0e69b2317
SHA1 2a6b6d936de9de848efffee62143c4c040930d24
SHA512 b84642a36b57af0c4a9e2aa43523437c5ab0e69f1b3dcc9b883c676f00db182d52ed3ad17a0e0eb845162df2ffce4432f97f11071763a24c39f90f2c007a3698
SSDEEP 384:OnPN6/F6qA9oz+EFRUeLq4+lLbK2lc+Qp/Aq5k+0SyIqLvs9XPuD:3cXX2LBjXPuD
TLSH
T14A72295B1922CE38D537877E5B9F3629EA3B612C5ED1243427EFB81423C636A17E2053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Size 17.8MB
SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
MD5 c6c9a3d440e436b8c28867f3c3955ce9
SHA1 208847cb98181e6ba434dd5ec17d686824604946
SHA512 2e1d53d773f57cf8c311674d60615602670d44af7a7545c60172ebbd47d6bb32e382c4cc91a5394fc1a51dab4b654be822f81f1ea963ec1176624b0bea6a6f1a
SSDEEP 393216:pqX9UazcYdpnzyXm++SSSCZMwh56qAgbITfTK3l76TmkrqjFWBm0iw+X:pqtJzcYnzoN+wCW4AAITG3lVkMgmeI
TLSH
T10A17124BA758562BCE3F07B74652563F373091197F835307209283281C6A7FBAD8DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Size 16.9MB
SHA256 0b1f4967da6aedb84344403dea789cee0c2836ec06e5725d05f900bd36f8ca90
MD5 142332d971204101b3b2ee5fff2754c2
SHA1 c920b0ec41013b7929de8851a29ad983fa7d05da
SHA512 5a8dcca864d9af4c3c837fdb5c20a9a322e5039feb9f68408247f16ecd50f55efd62e6425db960f8c121ac0d63e1da973ed0ce5d92fbb4fafac68a0bcf7543fe
SSDEEP 49152:wokwK55OGf0xzO7s31EVOfvrhcXritoOZtvGnEgWjXKQnBEkJm1ZI:Ln+SX
TLSH
T14B074780E7F95348F2F77F65EEBA50564836BE97EC29C75E0415050E0832A4899BAF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Size 5.2MB
SHA256 f64e64c7e88f00bb04b8264536e201291e9a3d669c36bd238cbaef8c26b62349
MD5 fb0415cd45cc1e782576f3e2e15ed43e
SHA1 3f7dd940d19cb6ee8a0f2f5395612fc0a5360e5f
SHA512 d29d4b43dea10a0c4d46b6c96d44854f00a7af431889601b31f2c1f6edcb475dd26f3021ddd9ec9fa878a921f4d679d412cca78ca213de250cc0b13bbaa53075
SSDEEP 98304:h4ydZOjlb3GaE1COMOIFGOOOOOOOOOOOOqLOOOOOOOOOO8:2lC09GOOOOOOOOOOOOqLOOOOOOOOOO8
TLSH
T1BD463803F19680E9C06DD579875EA623B632F8840B3676DF66A00F1A2E79FE0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 206KB
SHA256 8c964e34e98f4cdee4cbd297276c44265ace075fdb6bfe55b6068bea6d4ae409
MD5 481ef15fbb57f2eb16944cf401580f43
SHA1 7ea238cd917a5d1b51774d78ea2fd2cd3e5c7bdb
SHA512 774c5f2ac83def51be62cc01877b006bc7d7590c2be2cbf71021eda939377e15095e89f8cc7f34b3c67cfc0609e51b8b6ea0009e7cc6e347e4411b8b709e3d30
SSDEEP 1536:GfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJd5q:GVqoCl/YgjxEufVU0TbTyDDalbs
TLSH
T1D324E913BEA0547FF072CEF169A98B2DBA514E361B61BD472262AB50397200775FD20F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 206KB
SHA256 d02d5a3289472090d010e47808b3615f7cf4eaf4f6460358c6f8564637a5f04e
MD5 22e898c246389abf2a64a009540219b4
SHA1 d991cf31a52d41dbbcdf6221662a86ec0a54b656
SHA512 f91def04e2dc01600969dd4aaaced6a7e0912389246181e18595d7e846ed6b3a72e2e702c120f8fe30fa3074520b64087fee1476ad450ae398040dda8a894d35
SSDEEP 1536:GfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJd54:GVqoCl/YgjxEufVU0TbTyDDalbm
TLSH
T1FE24F7377910589FF81286F568B9C99FBE224D551BA56D03A3B2A728347210333FDA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4720_1246187851\manifest.json
Size 86B
SHA256 31a56f514d228a98683b8cbf7e8a3ced78857ef3e745a06fbc2c5b33162d3220
MD5 e97d9354ca8a054fb36d180f393b1252
SHA1 b3e4ec5a6a3751e6d9f0da1f0ceb8ad1da8520a4
SHA512 7c45acb49bc2e172fae8afa1ec2eb7df0b10e0ce774c578a2b2e68df5ac6d44dd81daa9373aad5ffc7db46073f53f29d3b8921ed2fbf9a47307c599b5bdba4d4
TLSH
T196A012623C00C92724C007640030438343653C0A7420250005521401A14473A01A6219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4720_1739688891\manifest.json
Size 108B
SHA256 33ead1b6d8fdf965b7f83f7ae86b21f2f9b440d77ca28d385929f599201490da
MD5 aea08f4542ef9177a08128d80c78a074
SHA1 fc87a2811d84f1ed99f068e0a6913d79d046c070
SHA512 9a6b38b0af206b8eac7c255f8ef11480f10302989d6c4329af6ea69d1d6b95b2539a0dee27b7b41bcb0d91dbc39f2d714725e282ad4abf413380ffad409cfbce
TLSH
T123B012B0BC8AA57710D03BB001A0A3C36FF17D0319356C1119337000117873971B231E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping4720_893206157\manifest.json
Size 94B
SHA256 95a2b0748baee70740ff2d5da78f98b5a29950562f989591f0b0b5bf13354b85
MD5 7130a770ae4db8eebc02a87bdee55e4d
SHA1 c27b743f556ce9e389cc8c33d89e590719d1f506
SHA512 2efd8fa39992cb928b432c12117a868da26dcb393073a1cae51ea6c93acb28a7be7eb5c37007db0b8eb7e40a2770cf50fbc2728b059adb61694d4c49339bde42
TLSH
T147B01210BC49917318C107541131829347761D01601529038F9F10D036E823D0262608
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe

Path \??\c:\users\admin\appdata\local\temp\2026-05-22_bd26b33bf12d3cad681c8124ac6976ff_elex_icedid_luca-stealer_njrat_swisyn.exe
Size 1.4MB
SHA256 52e412f950f1598c7e52936d759b793ed47a40897b704639b75aeed6ae3ac409
MD5 e744f988329ffe241e0f18e70bd043bd
SHA1 11c27fc6eee5302bbbce2fa380abf152d4673cf5
SHA512 426b14b83cfd790205e823d04b5b5df95f274a08d59eebc0d060ef8392cfe4dadb880859dc903d7032d2b957858a8ec521440f75b8271feb91a460c8ff33c98f
SSDEEP 12288:TmwW6APE/Xu2uA31/QnWpOL0WlBYLMlUYtwnd8LgST66B7DTSFi14jS:aCoE/huA3ynWp00WjYQuvS
TLSH
T14D657E885B68D97EE763D17D4055E23DEB323C220FC2924642EA52FC1EA7334756BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path \??\c:\windows\resources\svchost.exe
Size 206KB
SHA256 eb88f7748d2a5fdfb332461f71438b71175527dd3105cb3db0bf54b8762ec0e2
MD5 7a2d988e45e54129aa8e9c3b2e4dda0f
SHA1 7b454ea2aa58db8eeb2c99753e59b89b4b4d12d1
SHA512 3dba2ce8ab9a902144e488d18f3a6a33b6cf876a4739d55fd9239bf3d3f62685dc82fc20d13d0cb62f9e7e3536652a2cefbf2affb4b88afe43ffed4c98114c42
SSDEEP 1536:GfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJd5Q:GVqoCl/YgjxEufVU0TbTyDDalbW
TLSH
T129243A2B7E10503BF8958EF1ACD8EA5AB5530F2626906C835A53BF0939B114772FD327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path \??\c:\windows\resources\themes\explorer.exe
Size 207KB
SHA256 8fcc574b61ec364eef835b90111933569663feae4aa534edc5bdfb853814b40f
MD5 c42d7be83fb731bd4bcb5b41ff809415
SHA1 7dee9c1ad9488da545dea1d3aad47bda4513e4e3
SHA512 ad9f104b3a0ff981bc32e2e041705828a3d575312d7cc7c53d6490cfa351fc6410d9553079befa911e693bc5135e874cdb9113a778189d980ce99d2875e93b18
SSDEEP 1536:GfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJd58:GVqoCl/YgjxEufVU0TbTyDDalb6
TLSH
T10D240A337D81542DF56681F32856D56E7A236D2A2B90AD0727E2BB0436FA20335FC61F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-425-0x00007FFCFD1C0000-0x00007FFCFD1C1000-memory.dmp

Download

memory/1028-708-0x000001BEFA580000-0x000001BEFA5A9000-memory.dmp

Download

memory/1028-426-0x000001BEFA5B0000-0x000001BEFA5B1000-memory.dmp

Download

memory/1104-47-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1104-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1192-886-0x00000281F96D0000-0x00000281F96F9000-memory.dmp

Download

memory/1192-881-0x00000281F9700000-0x00000281F9701000-memory.dmp

Download

memory/1560-832-0x0000023E4D890000-0x0000023E4D8B9000-memory.dmp

Download

memory/1560-828-0x0000023E4D8C0000-0x0000023E4D8C1000-memory.dmp

Download

memory/2044-904-0x0000016478500000-0x0000016478529000-memory.dmp

Download

memory/2044-888-0x0000016478530000-0x0000016478531000-memory.dmp

Download

memory/2248-707-0x000001B09E8D0000-0x000001B0A1096000-memory.dmp

Download

memory/2972-963-0x0000018539A30000-0x0000018539A31000-memory.dmp

Download

memory/2972-978-0x0000018539A00000-0x0000018539A29000-memory.dmp

Download

memory/3096-764-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3136-768-0x0000023CBBAB0000-0x0000023CBBAB1000-memory.dmp

Download

memory/3136-784-0x0000023CBB570000-0x0000023CBB599000-memory.dmp

Download

memory/3420-40-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3420-44-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/3500-677-0x0000018C40F40000-0x0000018C43706000-memory.dmp

Download

memory/3844-684-0x000001E92F7B0000-0x000001E931F76000-memory.dmp

Download

memory/4352-45-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4552-547-0x000001B4BB850000-0x000001B4BB851000-memory.dmp

Download

memory/4552-713-0x000001B4BB820000-0x000001B4BB849000-memory.dmp

Download

memory/4720-686-0x000001DFA3470000-0x000001DFA3786000-memory.dmp

Download

memory/4720-750-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/4720-983-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/4720-384-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/4720-905-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/4720-824-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/4720-385-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/4720-786-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/4720-685-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/4720-857-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/4720-728-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/4720-959-0x000001DF9DD80000-0x000001DFA0546000-memory.dmp

Download

memory/5084-752-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/5408-835-0x00000198B4C60000-0x00000198B4C61000-memory.dmp

Download

memory/5408-851-0x00000198B4C30000-0x00000198B4C59000-memory.dmp

Download

memory/5812-706-0x000002255B500000-0x000002255DCC6000-memory.dmp

Download

memory/5812-804-0x000002255B500000-0x000002255DCC6000-memory.dmp

Download

memory/6044-46-0x0000000000400000-0x000000000042F000-memory.dmp

Download