Overview

overview

10

Static

static

3

2026-05-22...ar.exe

windows10-2004-x64

10

2026-05-22...ar.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 18:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe
  • Size 1.5MB
  • Sample260522-xdmfcadt7n
  • SHA256 7d5e454f983af61767acab18de9ab8122a551bf1783a8ab2e95c7d971b83f8cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 43 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 11 IoCs
    adwarespyware
  • Modifies registry class 29 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4308
    • \??\c:\users\admin\appdata\local\temp\2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe 
      c:\users\admin\appdata\local\temp\2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4108
      • C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
        SpWebInst0.exe /webinstall
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4660
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          Spotify.exe /INSTALLCOMPLETE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3772
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.90.451 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ffcfa345448,0x7ffcfa345454,0x7ffcfa345460
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2984
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2104,i,17850094061506460438,12356675441011098148,262144 --field-trial-handle=2316,i,13317079078083413746,13391384649523081648,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2320,i,15358030016848424368,17234300485528775279,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2328 --mojo-platform-channel-handle=2252 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4620
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=2552,i,10921170504696250369,7123164100333327508,524288 --field-trial-handle=2316,i,13317079078083413746,13391384649523081648,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2320,i,15358030016848424368,17234300485528775279,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2664 --mojo-platform-channel-handle=2668 /prefetch:11
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Time Discovery
            PID:2920
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=2880,i,7081451139176301303,16170777402012580429,524288 --field-trial-handle=2316,i,13317079078083413746,13391384649523081648,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2320,i,15358030016848424368,17234300485528775279,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=3096 --mojo-platform-channel-handle=3088 /prefetch:13
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:136
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1779474933831698 --launch-time-ticks=584799289 --metrics-shmem-handle=6284,i,10864712078655386339,12674920313461709861,2097152 --field-trial-handle=2316,i,13317079078083413746,13391384649523081648,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2320,i,15358030016848424368,17234300485528775279,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=6296 --mojo-platform-channel-handle=6292 /prefetch:1
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4976
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=7652,i,7651374132768689625,6577867885584242666,524288 --field-trial-handle=2316,i,13317079078083413746,13391384649523081648,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2320,i,15358030016848424368,17234300485528775279,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7660 --mojo-platform-channel-handle=7656 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4028
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=3808,i,14554599432843398326,13151442085688605082,524288 --field-trial-handle=2316,i,13317079078083413746,13391384649523081648,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2320,i,15358030016848424368,17234300485528775279,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=7116 --mojo-platform-channel-handle=2560 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4156
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.90.451" --metrics-shmem-handle=4092,i,16757690364886637555,8241962318274608902,524288 --field-trial-handle=2316,i,13317079078083413746,13391384649523081648,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2320,i,15358030016848424368,17234300485528775279,4 --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=7716 --mojo-platform-channel-handle=1500 /prefetch:14
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:728
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3296
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3032
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3428
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3612
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:992
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:4624
    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.90.451 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ffcfa345448,0x7ffcfa345454,0x7ffcfa345460
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3656

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Modify Registry

          4
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Discovery

          Query Registry

          3
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Time Discovery

          1
          T1124

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          data_0
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Cache\Cache_Data\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_2
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Cache\Cache_Data\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          index
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index
          • Size 24B
          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
          • MD5 SHA1 SHA512
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
          • Size 72B
          • SHA256 9b0b3f22d6764b6bf2ab7c9a9085782de4e9ad497ed7fd3acfec50e48311b752
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index~RFe5a2174.TMP
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe5a2174.TMP
          • Size 48B
          • SHA256 a0f3f0e1c8afdce82bdd2957df152a5f37a2c5965b039f7e38152585180635ea
          • MD5 SHA1 SHA512
          Submit Download

          data_1
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_1
          • Size 264KB
          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          data_3
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
          • Size 2KB
          • SHA256 fffef9dfda81817e8b825c1199020b101e9b59de4c324bda7a3519273523f03f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
          • Size 10KB
          • SHA256 c81e9773d2c071e20c01d0359924d02db5662be260bb7e528da481feffedfc6d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
          • Size 10KB
          • SHA256 40472a2e202af8e2e01043c7b253e78955de7ac2c64feb857a7d5640454dea6b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
          • Size 10KB
          • SHA256 6949b8de71144f70eff28de2fb4b61d9c6e652c6ebb8bae4e0092761fb300499
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences~RFe59da2a.TMP
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe59da2a.TMP
          • Size 9KB
          • SHA256 c572a952f5fd0603e1ffe42cbe33b05d76890e99c2776e69f5443df87d32220b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Secure Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Secure Preferences
          • Size 9KB
          • SHA256 5cb8d301b566d4648c906ccc748e38d82cf0835f05a9b0c0f1ee591db6f6d845
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Secure Preferences~RFe59b02c.TMP
          • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Secure Preferences~RFe59b02c.TMP
          • Size 9KB
          • SHA256 87d6172eb02b20341190fe4a65f3f82523bc9e79af8a3413cd54076ca5b84248
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
          • Size 922B
          • SHA256 5c2cc612cc0368ca806e822b5e0493f1fede6086dd2f5b78d685a06b66a6b887
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
          • Size 7KB
          • SHA256 31315e1b52f4330d4eb2d30db14cf584ed964f40c87b7fa5bf677fe0fb5c945c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
          • Size 8KB
          • SHA256 bca91fadff0ff7ab06198d71359efed7b5c24457696fe9a03301b3e65c4c6f3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
          • Size 8KB
          • SHA256 2ef7df5265cbd403cab99d1d236180469497492740c3269573b44b68a674ac32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences~RFe59b02c.TMP
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe59b02c.TMP
          • Size 7KB
          • SHA256 f05e62cc27278673513c0dca2d2158e5a4d0a3e75ff2532e49cc389154de470f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Spotify\Local State
          • Size 2KB
          • SHA256 e01441847ba98cca90fef731cf7f6f41aad57c315b0117c07f79c6040414f7be
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Spotify\Local State
          • Size 6KB
          • SHA256 0ae842aac90deb7be236caf5d7bfc9e2abe7f6f8d55d5b0686e8d3b0d7dce4f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State~RFe596af5.TMP
          • Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe596af5.TMP
          • Size 1008B
          • SHA256 47cdda197d8f87eae763fc53cb6f03d5d57f631a2a92e459f5e74ade9aa5e9f2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          manifest.json
          • Path C:\Users\Admin\AppData\Local\Spotify\PrivacySandboxAttestationsPreloaded\2025.6.16.0\manifest.json
          • Size 97B
          • SHA256 335b1566f2a398f764be95e60ea16352e087262dfffa2616576bb22947d7e4bc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          privacy-sandbox-attestations.dat
          • Path C:\Users\Admin\AppData\Local\Spotify\PrivacySandboxAttestationsPreloaded\2025.6.16.0\privacy-sandbox-attestations.dat
          • Size 7KB
          • SHA256 d5fbb03c2733c6670d21968bd057f315d56640f4e9dc3333f60e0b81fe3920d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
          • Size 56B
          • SHA256 c8329c3bb734d8c6e37a4ce23ca99efec4f4812e53948f3d4dfe3baf6a95ef38
          • MD5 SHA1 SHA512
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
          • Size 124B
          • SHA256 418e37a64c865013c87c6d30e5094d292fa74fb46e449d968ac83f492e46407b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          09604d28-4ffa-4bf8-802f-886f88c7b481.tmp
          • Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\09604d28-4ffa-4bf8-802f-886f88c7b481.tmp
          • Size 13B
          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
          • MD5 SHA1 SHA512
          Submit Download

          000002.dbtmp
          • Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
          • Size 16B
          • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
          • MD5 SHA1 SHA512
          Submit Download

          2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe 
          • Path C:\Users\Admin\AppData\Local\Temp\2026-05-22_cf1358ce287678ad9c93b2368deff5ea_cobalt-strike_elex_icedid_luca-stealer_njrat_swisyn_vidar.exe 
          • Size 1.4MB
          • SHA256 9d2f39c5a398da813ddaa106ec1ce49c53319091703fde018a2058ef98504c17
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          login.spa
          • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
          • Size 3.8MB
          • SHA256 72f7f40d5a65a0074c2745ca485a609e835f8abf2429c8dbd795174bac5c0bd6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Spotify.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
          • Size 39.5MB
          • SHA256 1410132f753656fbdb18ad9fb7f94565000c85704b3f4db48c1ab705d367ea7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Spotify.exe
          • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          • Size 2.8MB
          • SHA256 305e8f96a7bfb83f600d4f4dec4d169ab9dd4d5cb7b77b2e1da28cfbe2d58cc6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_100_percent.pak
          • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
          • Size 705KB
          • SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_200_percent.pak
          • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
          • Size 1.2MB
          • SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          chrome_elf.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
          • Size 2.4MB
          • SHA256 9eaf3adaf1ef4a7f0639e6e2b1855bfe2125271342faeb2eac40d2039e84d8d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          crash_reporter.cfg
          • Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
          • Size 632B
          • SHA256 edc24259c1f3013abdb8c6262b5c8aa9d3656ba38e515f88cc797bf5b9456b31
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          d3dcompiler_47.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
          • Size 4.5MB
          • SHA256 68ff9808c208eef52df74895a29ce184335a6332aad3cebbd64f6111805bc745
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icudtl.dat
          • Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
          • Size 10.3MB
          • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libEGL.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
          • Size 504KB
          • SHA256 3f7027612c5f2b472fb725f2869666ad2a5e9e4e0d7c8c0d82c21450741ccc11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libGLESv2.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
          • Size 7.5MB
          • SHA256 63aca2cc923b97b55dfc47146cae1cc3abf744c204ac4305ef3acc53704af8ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en-US.pak
          • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
          • Size 577KB
          • SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en.mo
          • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
          • Size 16KB
          • SHA256 aa146c3fbb7af8381836b0c7c2569a13c1494c26994b996f94cebf272b59fa9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zh-Hant.mo
          • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
          • Size 16KB
          • SHA256 df81711e5812dbd894e74e1904006138c4358659b5175899df0bb9db10e57bb1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          resources.pak
          • Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
          • Size 17.8MB
          • SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          v8_context_snapshot.bin
          • Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
          • Size 16.9MB
          • SHA256 0b1f4967da6aedb84344403dea789cee0c2836ec06e5725d05f900bd36f8ca90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vk_swiftshader.dll
          • Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
          • Size 5.2MB
          • SHA256 f64e64c7e88f00bb04b8264536e201291e9a3d669c36bd238cbaef8c26b62349
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          explorer.exe
          • Path C:\Windows\Resources\Themes\explorer.exe
          • Size 135KB
          • SHA256 6ee23e032d01506a4206cb748f86e70ff90d53c3e11ce69d3d2128f7bb876d61
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icsys.icn.exe
          • Path C:\Windows\Resources\Themes\icsys.icn.exe
          • Size 135KB
          • SHA256 10175f2413a3303e7640d955d3ef1ecb8474bd67a18935e7951e90271f0f6a9f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spoolsv.exe
          • Path C:\Windows\Resources\spoolsv.exe
          • Size 135KB
          • SHA256 6ed56692a31abad1a47dc6ce501c5ae0ded5725d6d8e05ddc24931ed54f35cce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          svchost.exe
          • Path C:\Windows\Resources\svchost.exe
          • Size 135KB
          • SHA256 386957d859e3c151ae9be0d535d5308a8d2d9cf191d7c1601a1d5af9737367c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          manifest.json
          • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping3772_865808391\manifest.json
          • Size 1001B
          • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/136-424-0x00007FFD08C90000-0x00007FFD08C91000-memory.dmp
          Download

          memory/136-423-0x00007FFD08910000-0x00007FFD08911000-memory.dmp
          Download

          memory/992-46-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/2296-647-0x000001E192470000-0x000001E194C36000-memory.dmp
          Download

          memory/2920-830-0x0000020732330000-0x0000020734AF6000-memory.dmp
          Download

          memory/2920-904-0x0000020732330000-0x0000020734AF6000-memory.dmp
          Download

          memory/2920-546-0x0000020732330000-0x0000020734AF6000-memory.dmp
          Download

          memory/2920-680-0x0000020732330000-0x0000020734AF6000-memory.dmp
          Download

          memory/3032-935-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3296-52-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3296-12-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3428-49-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3612-936-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3772-382-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-589-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-724-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-933-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-676-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-819-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-677-0x000002B0D7AC0000-0x000002B0D7D38000-memory.dmp
          Download

          memory/3772-381-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-780-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-790-0x000002B0D7AC0000-0x000002B0D7D38000-memory.dmp
          Download

          memory/3772-849-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-515-0x000002B0D7AC0000-0x000002B0D7D38000-memory.dmp
          Download

          memory/3772-869-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-514-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-681-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-905-0x000002B0CBCC0000-0x000002B0CE486000-memory.dmp
          Download

          memory/3772-594-0x000002B0D7AC0000-0x000002B0D7D38000-memory.dmp
          Download

          memory/3772-906-0x000002B0D7AC0000-0x000002B0D7D38000-memory.dmp
          Download

          memory/4028-771-0x00000161A1080000-0x00000161A3846000-memory.dmp
          Download

          memory/4308-0-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4308-50-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4620-522-0x00000220E2ED0000-0x00000220E5696000-memory.dmp
          Download

          memory/4620-678-0x00000220E2ED0000-0x00000220E5696000-memory.dmp
          Download

          memory/4620-809-0x00000220E2ED0000-0x00000220E5696000-memory.dmp
          Download