5abf1b49303f2ce9947d19cd56bb4b12787aae5e43405e69b91e31ccff417cb5

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install_Auto.bat
Size 749B
Sample260705-wckppaat4n
SHA256 5abf1b49303f2ce9947d19cd56bb4b12787aae5e43405e69b91e31ccff417cb5
MD5 d05cf77189ee9d45c64132b26a3de7aa
SHA1 a8ae8a1647d018f52355640bb9dd6ffa33e00bec
SHA512 01ee90e4383f73efc1fe9290e05b3689d12dc3f3d42264cb97c87ee8824aa1d0401e598ef27f96df668e94230a011d43dc32f5972678d639c019a7443c7fe8b0
TLSH
T1D1016AE3E18E2E664C5B45F551172A5C01CF5195E77594D513F3CE846DC63CC4544342
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware discovery execution persistence privilege_escalation spyware

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4844	powershell.exe
6	4844	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 12 IoCs

pid	Process
2548	SpotifySetup.exe
3404	Spotify.exe
5908	Spotify.exe
4504	Spotify.exe
3164	Spotify.exe
720	Spotify.exe
1808	Spotify.exe
2824	Spotify.exe
2344	Spotify.exe
3636	Spotify.exe
3752	Spotify.exe
1068	Spotify.exe

Loads dropped DLL 33 IoCs

pid	Process
3404	Spotify.exe
5908	Spotify.exe
4504	Spotify.exe
3164	Spotify.exe
4504	Spotify.exe
4504	Spotify.exe
4504	Spotify.exe
720	Spotify.exe
1808	Spotify.exe
1808	Spotify.exe
720	Spotify.exe
720	Spotify.exe
720	Spotify.exe
1808	Spotify.exe
2824	Spotify.exe
2824	Spotify.exe
2824	Spotify.exe
1808	Spotify.exe
1808	Spotify.exe
1808	Spotify.exe
1808	Spotify.exe
2344	Spotify.exe
2344	Spotify.exe
2344	Spotify.exe
3636	Spotify.exe
3752	Spotify.exe
3636	Spotify.exe
3636	Spotify.exe
3636	Spotify.exe
1068	Spotify.exe
1068	Spotify.exe
1068	Spotify.exe
1068	Spotify.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spotify = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	Spotify.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4844	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
720	Spotify.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Spotify.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\CLSID	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\AppUserModelId\Spotify.desktop.client\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\AppUserModelId\Spotify.desktop.client\CustomActivator = "{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}"	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\AppUserModelId\Spotify.desktop.launcher\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpotifySetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\AppUserModelId\Spotify.desktop.client\DisplayName = "Spotify"	SpotifySetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\AppUserModelId	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\AppUserModelId\Spotify.desktop.launcher\CustomActivator = "{18A68F64-72DD-42CE-A75D-EDBDAC226F5D}"	SpotifySetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\AppUserModelId\Spotify.desktop.launcher	SpotifySetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\spotify	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" -ToastActivated"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\AppUserModelId\Spotify.desktop.client	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\AppUserModelId\Spotify.desktop.launcher\DisplayName = "Spotify Launcher"	SpotifySetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeIncreaseQuotaPrivilege	4844	powershell.exe
Token: SeSecurityPrivilege	4844	powershell.exe
Token: SeTakeOwnershipPrivilege	4844	powershell.exe
Token: SeLoadDriverPrivilege	4844	powershell.exe
Token: SeSystemProfilePrivilege	4844	powershell.exe
Token: SeSystemtimePrivilege	4844	powershell.exe
Token: SeProfSingleProcessPrivilege	4844	powershell.exe
Token: SeIncBasePriorityPrivilege	4844	powershell.exe
Token: SeCreatePagefilePrivilege	4844	powershell.exe
Token: SeBackupPrivilege	4844	powershell.exe
Token: SeRestorePrivilege	4844	powershell.exe
Token: SeShutdownPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeSystemEnvironmentPrivilege	4844	powershell.exe
Token: SeRemoteShutdownPrivilege	4844	powershell.exe
Token: SeUndockPrivilege	4844	powershell.exe
Token: SeManageVolumePrivilege	4844	powershell.exe
Token: 33	4844	powershell.exe
Token: 34	4844	powershell.exe
Token: 35	4844	powershell.exe
Token: 36	4844	powershell.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe
Token: SeShutdownPrivilege	4504	Spotify.exe
Token: SeCreatePagefilePrivilege	4504	Spotify.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4504	Spotify.exe
4504	Spotify.exe
4504	Spotify.exe
4504	Spotify.exe
4504	Spotify.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4504	Spotify.exe
4504	Spotify.exe
4504	Spotify.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2780	explorer.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 4844	5800	cmd.exe	89
PID 4844 wrote to memory of 5936	4844	powershell.exe	91
PID 4844 wrote to memory of 3668	4844	powershell.exe	92
PID 4844 wrote to memory of 4964	4844	powershell.exe	93
PID 4844 wrote to memory of 5368	4844	powershell.exe	94
PID 4844 wrote to memory of 6016	4844	powershell.exe	96
PID 2780 wrote to memory of 2548	2780	explorer.exe	98
PID 2548 wrote to memory of 3404	2548	SpotifySetup.exe	99
PID 3404 wrote to memory of 5908	3404	Spotify.exe	100
PID 4844 wrote to memory of 3384	4844	powershell.exe	102
PID 3384 wrote to memory of 476	3384	csc.exe	103
PID 4844 wrote to memory of 4504	4844	powershell.exe	104
PID 4504 wrote to memory of 3164	4504	Spotify.exe	105
PID 4504 wrote to memory of 720	4504	Spotify.exe	106
PID 4504 wrote to memory of 1808	4504	Spotify.exe	107
PID 4504 wrote to memory of 1808	4504	Spotify.exe	107
PID 4504 wrote to memory of 2824	4504	Spotify.exe	108
PID 4504 wrote to memory of 2824	4504	Spotify.exe	108
PID 4504 wrote to memory of 2344	4504	Spotify.exe	112
PID 4504 wrote to memory of 2344	4504	Spotify.exe	112
PID 3636 wrote to memory of 3752	3636	Spotify.exe	116
PID 4504 wrote to memory of 1068	4504	Spotify.exe	117

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install_Auto.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-confirm_uninstall_ms_spoti -confirm_spoti_recomended_over -podcasts_off -block_update_on -start_spoti -new_theme -adsections_off -lyrics_stat spotify -no_pause'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/SpotX/refs/heads/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/SpotX/run.ps1' })} $p """" | iex
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -V
    3⤵
    PID:5936
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" --help all
    3⤵
    PID:3668
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-05_18-47-28\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.93-x64.exe
    3⤵
    PID:4964
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-05_18-47-28\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.93-x64.exe
    3⤵
    PID:5368
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-05_18-47-28\SpotifySetup.exe
    3⤵
    PID:6016
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jkurghm1\jkurghm1.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BB7.tmp" "c:\Users\Admin\AppData\Local\Temp\jkurghm1\CSC3102C9B5CA2435C9733B42A876FDF0.TMP"
      4⤵
      PID:476
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.93.667 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ffc9dad5448,0x7ffc9dad5454,0x7ffc9dad5460
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3164
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.93.667" --metrics-shmem-handle=1944,i,6278173633018720955,9250463990918365072,524288 --field-trial-handle=2060,i,11472579194637654446,5563836906855151267,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2064,i,1844298124481372742,1903455964492579035,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2152 --mojo-platform-channel-handle=2148 /prefetch:11
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Time Discovery
      PID:720
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.93.667" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1772,i,2186157410471555502,11296282794377434414,262144 --field-trial-handle=2060,i,11472579194637654446,5563836906855151267,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2064,i,1844298124481372742,1903455964492579035,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2068 --mojo-platform-channel-handle=2052 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1808
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.93.667" --metrics-shmem-handle=2512,i,5947330284830369848,18309884476328657891,524288 --field-trial-handle=2060,i,11472579194637654446,5563836906855151267,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2064,i,1844298124481372742,1903455964492579035,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=2380 --mojo-platform-channel-handle=2684 /prefetch:13
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2824
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.93.667" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=6140,i,7628759407246936607,15167019747651853938,2097152 --field-trial-handle=2060,i,11472579194637654446,5563836906855151267,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2064,i,1844298124481372742,1903455964492579035,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=6172 --mojo-platform-channel-handle=6168 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2344
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.93.667" --metrics-shmem-handle=7216,i,15186827849759810039,17265128349641276568,524288 --field-trial-handle=2060,i,11472579194637654446,5563836906855151267,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2064,i,1844298124481372742,1903455964492579035,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7224 --mojo-platform-channel-handle=7220 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-05_18-47-28\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-05_18-47-28\SpotifySetup.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe /INSTALLCOMPLETE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.93.667 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ffc9dad5448,0x7ffc9dad5454,0x7ffc9dad5460
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3964

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.93.667 --initial-client-data=0x230,0x258,0x25c,0x254,0x260,0x7ffc9dad5448,0x7ffc9dad5454,0x7ffc9dad5460
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 574ae0d6929d9037e7813bc8b0256ed73282de90ce6e7ad02e3eba72044a5080
MD5 074ddfb73eb623bdef363fd14c7227ce
SHA1 9b8c549f4fa669aabf95f1f365ef6c2928dbd8d0
SHA512 0b3612e241b9e79d288da759417dd939959cb9afe9bb04e184359800b23f11016e721fab2bd5d6a7136553c6dbbb55c6628ae3b8699f5592a44907b8f540d5de
TLSH
T123A002A98D5191E2C25D267574454AB133185DE4221F07ADD4A120FCD8582454643555
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b2883.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe5b2883.TMP
Size 48B
SHA256 06639fbe9f5b316599c6809c3b04e06361ac1efbc9c29d016365cccc18cc640b
MD5 683932c1998e74bf0b0f43cd7cce6da8
SHA1 6ecef07e150bba2702fc4a4a74122a7ad923f1b3
SHA512 46f36b1154e7b489797c6cf55511691aab4e8473eaede12685ced9bf8be48f0e0628db22ce590a57316ed8e54fbe074b1e13aaf2ddea13e7ffb0ec9393b11780
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
Size 10KB
SHA256 b92e86b8d0fad19e2229552cb2aae00cd0833ee66551267509fb926abf63414f
MD5 ab66ef31abda362a340344f777c918ce
SHA1 954980b5a1d4b1785f3da60521dce4858d5976d4
SHA512 9cb7ad364fa7850a7fe69b038497dcb9386c744dd9fcd02e34b155138a8cca6bfbc64a1abacdfbf307d0eb5b8d6440cee6420549c7c8da0af369d9445defa543
SSDEEP 192:zRjwuZZ7b2E0v7N4F9QdHcb+WNVEAEHEAEUdEAE7BImC1cf1fr/yIsn2Kgw:zRPZ7aEw+KNgepkpNp999f1fpw
TLSH
T1F722B41BAC689A3B6CD7D629F9347B43E7F9042125A07D48DBFC8A2C16DB6CD2113463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5b13d3.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe5b13d3.TMP
Size 10KB
SHA256 68e0f762ddb8eed82aef182067dc884bc597767a8f4bf8088dc0b3f38d3a6692
MD5 4c459d6f36a8ec4e1bfd83eafc3af6e9
SHA1 82465c646c0398a3489ef29413735bebf74a5f75
SHA512 0d188f1b2130b19398bfbf9a1931f5004e8c0586381ee34297b012009edac61160dfa0078e3cf4550c32f997e4c7233333fae9c54e40a7c6ba3fccbb433e3841
SSDEEP 192:zRjwuZZ7b280v7E4F9QdHcb+WNVEAEHEAEUdEAE7BImC1cf1fr/yIsn2Kgw:zRPZ7a8w3KNgepkpNp999f1fpw
TLSH
T17122B41BAC689A3B6CD7D629F9347B43E7F9042125A07D44DBFC8A2C16DB6CD2113463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
Size 8KB
SHA256 6217a2e79099ac2ce2848af038546c77881d33c9ddd3ec6c66ec96e79c71dab8
MD5 7b298f224d5d98566cf87de8f08ddc44
SHA1 33097dfdf84f4d3fbbbb400d616ca50c7139f90b
SHA512 288dff2b1691052d5f6071613743246d4143e693209c10fba9e98e94a2cf6401cd0fb40fd8188b3019ff843d8fcc5537e71a2df968aa2cc5170a3bf7a8483078
SSDEEP 192:zRwwz5Qctev7xzIf9ndHcb+WNOsO/yIsn2Kg5:zR15QxEZNgI5
TLSH
T10102A52EAD24967F9CD2E319F9257B42E3F5102135A43D48DBF88A2C28DB6CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5ad7e3.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe5ad7e3.TMP
Size 7KB
SHA256 a4ea8a3f4b2a5a9c6325cc6c870bc7ed6b71dc1e90c8c65d68c14f6eda75d6cf
MD5 b1e236a5079ea14270c6e51e6c92afcc
SHA1 da747f30c5940c70c8bf1e4e2fe72e5388ad0a51
SHA512 2fcddaab3a8f77d5d00cf681ed829f3d6f7e1e58c9a86fc7ade6bc1a02e05442d4ed7209274f84415349a2e9a8fc8821e4332495172386cba10806b03c8064da
SSDEEP 96:zR7qsUrSV4fxwtv7xHdKWCjwAeuX796b+WVoMPktNm+Tem9jWZ86rNLCyIsnIW4A:zRmsuev7x9IfXcb+WNOs30yIsn2Kg8
TLSH
T152E1661EAD28AA7F9CC2E365F9257742E3F5102135A43D48DBF8896C28DB6CD2237417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 3KB
SHA256 dc881486cb045a0f36cfc75c1bfc8e7f6eed825fcd84aae9efd378355bc6b8fb
MD5 1dfc2b0050cde5744dabeafb597d9b38
SHA1 1361499f22ef75008f4d507acf7c4a028b00dc83
SHA512 67058e0788a47cd657870073ac29be247914268943af57ee4a6cbca3ecf9d4c4ae9e08d6ce8ef0555a1de182ba911bac0efa2e28fd914ca0295f52d2fdbfc4cc
TLSH
T16161A62668A8DD77A5B7D490B4522A03EBA92523A2647EDCD9FD0B0C02EB7DC2343513
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 2KB
SHA256 66c38534f365531fd92c3197845106cdaf59c2bc3625e927ee20cf43cc535854
MD5 fd029fe79f690ffe5c6f7686aaeefba4
SHA1 33828f533fc6c0c7e4964749b980ddeed8ff53a4
SHA512 6044a0eef2675179aa3d3afe2f1a1c60861fff359d6df5b53aa4f14cd8bba1bdc230e8eb6af4030a349cc237fafeba38927c82d9bf1840f51efb03c5de187bd8
TLSH
T150519836A8A8CD73A5B7C560B4572603CF792166A2607ED8D9DD0B1C03EB6DC2343453
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 6KB
SHA256 ed89a0c9f4aa9c3249753dba3f494754100bda07306cf4ccf4e121996e5ab0d1
MD5 198309fe7d059e3ec2b4ed16bd51a94a
SHA1 d69d65c4e7922ad78e7b449a31387289bfbbdcb9
SHA512 e28d99e11ebb5cc20a6d75fe7ea7baa8498720ccfae931f355000fa51491f45b7d0fa424512b6e114e934a9f18a55797e26300a8459d84c3236633ee151a7ab9
SSDEEP 96:VY4bJ61fBXa+Dotoh+DotoyN5HD9FDWB65Gyv2mOEW7oA1nBQM6iMwea:NtoRDUxDUBHvGlNuWTnebiR
TLSH
T174D1B63AEC8ECA77E8EB85952B81F686EF54526513905ADD8CD94D0C01DFEEC3242C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5ab102.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe5ab102.TMP
Size 1008B
SHA256 c4c975afcb08d8d2ef29ca93ced560a960068b2abeb51d16679af91c50bb0465
MD5 a058be6a3ecf5bad77ad8adbd3a3a72f
SHA1 d4a56d6ce0086c609a4b5c828b6f889083b2cbc7
SHA512 cc1ddc13f031e28f4ef1ff4bc38a31b45cd9f9eaf4b6e8439a100f3cac773698455808d57b41acb97a7cb06c1e5163b84fb6c6468630726699d3f8df946b7442
TLSH
T15F119473DC8077A2FDD1D5B421A723835F2A113242944ADCA5DE072303FBA4D26038B6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Size 56B
SHA256 0be7e0cc616e71dc226f8136337c0ced89e6cd3025f2406388beffdaa7117f6d
MD5 1a822476c7901d19e617a99a03f284ac
SHA1 ef264cefcc7e5dd427af35af972bcc49fdb571ad
SHA512 4bab864b90f7cf003691ff01b488072892acbede3a0c28f3e32f0ee7764cd7d41bf35af62394a49dfb65f2a539860fc280ffc678dadbe717ac50a07568b3bf3d
MD5 SHA1 SHA512

Submit Download

fa5af6f1-3f5b-45fc-ac93-a8778a437918.tmp

Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\fa5af6f1-3f5b-45fc-ac93-a8778a437918.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

RES1BB7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1BB7.tmp
Size 1KB
SHA256 ce5e14f13f955b12f49b908a744d3f95acdbb9ac6193d0313a1ce374c39107e4
MD5 3556202332f670b7df3e41b26f1211fd
SHA1 492926d79b99ef7453fe9ca22c8a67adfa1b04c7
SHA512 530179d127aa59689ee75dc1597ade13f506eb9cbb870848160e0ecdd97cd6e7a2cbde5661dcf320653de84ea59b6165bba281be4a73a92dd47a26d0ca63bd6c
TLSH
T18721EB05D3EC4B1EF0B7473269FA0B2F9674FD64EFA1679B9940422C2C61110EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

jkurghm1.dll

Path C:\Users\Admin\AppData\Local\Temp\jkurghm1\jkurghm1.dll
Size 4KB
SHA256 7bff3d0132cacc6c3afd38671dbc4a98fde1c233c1eb2a90d7bb0ede954ca0fd
MD5 c7a80355c1ad6cee0b36c7989eb84831
SHA1 1c4ef3b04bb3fea365c6ba36f0620dd5912aa09f
SHA512 4332aee8875272dfcb475f1f4dd043c074cb83822071292c43f18139809079b78a1ce82efc66e7ecfd35386a7bb3b906880799e6439bcc7502cbe824f077bdd1
TLSH
T1C481660A93EC556AF8B70731A6F343563770F8109A72932E58900238BC617A99E35FB1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
Size 3.9MB
SHA256 3a0a62798e6113857bd5d265550e0f0cf41cc7515e5beb1713150d72f8d919c4
MD5 cc67d20aa321ac505ca593d5b9d654d0
SHA1 6e35479b8e52b31030278c4095f227a61de49dd5
SHA512 594e6adffc0c5c522c5c5ab8b7e7ebec9fd0d035c6fcb43bc376160375774b8091aa7b5858d9a1624aa24f2f92469edcbd2dd112738313aac0ffb3d1b532771d
SSDEEP 98304:p8IVIuXse9SQOuURfomiedaAKHZ9QSEHEvfVUx6Mggcz:p8Cpx9fYozHZ94HEvqgMk
TLSH
T1E31633FC82F81A46C16D2931E5E80F16F9561EE30991FF19F89892F32A463C78BB5474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpui.spa

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
Size 10.6MB
SHA256 0b92446461e7e990cc10bbd56afa4d44c27501736c8b9799ec15bd084bf222ee
MD5 7a7d811ceb23ec7ce971a0a12aa338d0
SHA1 7f52a88682f696836f619dfe64c4c8e96cac9697
SHA512 6cc2de4131f11debbb11fb5d033c7fd1f2893b0e6ae02c27361968e336bac042b444868e2942084327e43c11618d92a2467134357bad8ca581bf85d923956d5b
SSDEEP 196608:WHCwr89Tan4Ha3v+5HPV8PFljA1eY5Gli9G+XwCzkuBI6YRj/T:FeE1dPVQljA1eVi9G+XwCIoFAr
TLSH
T124B633FDD7600942CD2E40B5F86E0B65D98B87824503FA962A1DA2D52E0F3CD7FB1B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpui.spa

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
Size 7.2MB
SHA256 c819900b988f2ee19e8ff70ce0e11dc570962217c9baf0a7e4ffda33970d25e9
MD5 74384b30cc3c12c97feefb8699bbdb46
SHA1 c7207ea2fcd12d8202471f592e432a4c0a2454dd
SHA512 f5ab5a4d77884ef8e778937ff25170e1ddcba00b65c828ef450d002e11593a5d07c80bf3d59ca14a6322f277c71e1e00d53e3c00dd6f7009894df853827fe2dd
SSDEEP 196608:WHCQr89Tan4Pa3J+5Hx38PFljA1eY5Gli9G+XwCzkc:F+Exdx3QljA1eVi9G+XwCIc
TLSH
T17776336CE7502996C82680B5F5BC5F76D68B47126611FBE5180E92E83D0F3C8B632F8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpui.spa

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
Size 12.0MB
SHA256 6c021504a28727e30d47ceb6b76eb86616aab0c71f1b3d8792441104c9fafabc
MD5 4af6a9d28f972ca253c82f7690ff6d0a
SHA1 5653f28755d9062efe2881ee98d37c19ccdd0c9b
SHA512 18faf408677edc1c230ec929a5ba568c858d1636f8bd6e629b4a76a72236b8edcad24d8f6554a3f2ab641fc0fe564d0f47108db6118abaf60b912f90d6cd1d7c
SSDEEP 196608:XF/Y9Kyr89XoHw1e31B+TD0uPzmzU5ri4MxxBH7r5CixVr8o4jIQYRHNbVfW7Y:XFKccHlB+TDqOitfH7r5x9I3QnWE
TLSH
T19CC633EDEA640A81C86E99B1F40E1F55CA9AC7810A03F5051F2D45E27D6F38E7FB170A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll
Size 4.5MB
SHA256 67dfec67c30d8a439009896f5a800d652e10e27f3b3c27eedbb3e042a7105903
MD5 23a4727b44d091f741087eac1941e73b
SHA1 e14a6087aec318562d928a68baed23dd848b26e9
SHA512 66b4fc1f6fffced7778701cd27bc0555e5d6fc9408c0f59c6c5e574be3dd3d2895c2d0bd8f1fe21c0cac495cd8261b16faf1227f2debd9812365ecbe8ab7a7ac
SSDEEP 49152:VSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxq2:YuktcrfNlTyj5byqSV
TLSH
T1B8268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.0MB
SHA256 cef6b4ef24cc7895a3c2323ba3d177480b913cad55ef5b6e9448c81697bab4db
MD5 66a21fbb84ace2af21fec3a62379372f
SHA1 8ced322b6f8b1b3d45e45f7f9f6a1ecae4cb1720
SHA512 0ba43052e77fefdaab0bc56e716f5df39f1d03944ea0fddd0a4640cf822ff147eeecc24c28db0ed48195cb05ca55b4ab83ea97277898ccd58c1d6b008abe7656
SSDEEP 393216:Jaayyp5MJf5mk55/kcJ/EnnNKvuM0Rtd3VgK3IrJn3xFEflDZEE:xyma5/kcJ/s4TJTEflFEE
TLSH
T173978D9B72E400ACC0AEE1BACF17DC17E7B7744A4771A34F02A092625F67A60563F761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.0MB
SHA256 c5f21531d222fc4ee4e0111d949766019455eae9d07d8fc8a8c3809a1b176d91
MD5 b93aef4f4391c741474c33f797ef224a
SHA1 430f5b9f98b4b692d7d1d70ab019ef93dedc8366
SHA512 602be4a79401c42596902ec62168ac84dd1d10701a6dc4a139cfe67a00935609983f2a30cd6470ef12d55e9e24df2363718d05ff2af98c44c17c834eb6df48be
SSDEEP 393216:Jsayyp5MJf5mk55/kcJ/EnnNKvuM0Rtd3VgK3IrJn3xFEflDZEE:Pyma5/kcJ/s4TJTEflFEE
TLSH
T137978D9B72E400ACC0AEE1BACF17DC17E7B7744A4771A34F02A092625F67A60563F761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.0MB
SHA256 85d35f83c7a25869301bc583c94ed2000390335ba250c3ac30619e2a5601ea62
MD5 bca3561bf7c4f1a8b81ebd83a5cf5fcd
SHA1 65ce9a5808688563b729a3384297d7dace0cf1a0
SHA512 48da5ded1a6ac8433e347177ee26f2c100133dfb914f87150c000951b794c80cfe2982106836749c431677f3ab13731c14c94dd6c37ef2416cc76e938904de3e
SSDEEP 393216:Ssayyp5MJf5mk55/kcJ/EnnNKvuM0Rtd3Vgw3IrJn3xFEflDvEE:+yma5/kcJ/s4dJTEflzEE
TLSH
T11A978D9B72E400ACC0AEE1BACF17DC17E7B7744A4771A34F02A092625F67A60563F761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 3b926bb42ae00036b56f5bc67615f4b7f967167ab2b92afe22be095d86496fd2
MD5 4ae0616f4b89939f0a761ba2d40587d3
SHA1 652ef64d54b81b1f59314f47570f72d6b6bff503
SHA512 067deec1dde3e2c9d25e612a81ff6526fe730b9bfb8c7bb8e0888b53dca29c52a756d92bb25b5a9e351a41f8c09a8e37f71d582a246603fea4baaaaba47cb024
SSDEEP 49152:iHYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+dil:iHYg8xwfGrUA9Ncnas8jdc
TLSH
T121D57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 5d42fe3a552ecb85dea50c6605784f35dd3173071715490d64cc5b5b761acdf3
MD5 3065dec268a9621ca843869863c5e4cf
SHA1 f7ac3ecad0a8af367e5559befdd8dd15d22f663c
SHA512 559cfd96570fbef2c81aef80df909cc558dba9270d3b19e9b3a63426a3bea37dcc595d96c2e430354b59cc0d91279c68f288e271659a224ba6c0e19a9f39c218
SSDEEP 49152:rHYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+dil:rHYg8xwfGrUA9Ncnas8jdc
TLSH
T129D57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Size 705KB
SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
MD5 0321d6c44a6041910208ce3891727842
SHA1 42e8935bd94f0fa3fd8611fc84e25a06e8ba82ed
SHA512 6c9348ed4d50fb2503012b80c0dc8f4cf07d00d2ff857fff8c102266533e65befc6535998f9497fe414cd427dfaf0ff3e5cd1b586addba236b3794768e3d476c
SSDEEP 12288:bI3H1fJwhjzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnSzm5dVYJblIt6kjKQCrC:U3VBE7zEEmPL8bTe+gnSzm5d2bc6kGQt
TLSH
T1FCE412E77374AC7DEE9B1277826505B0FC371A681B82020A179BF8796913B48D8C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Size 1.2MB
SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
MD5 d995543b367f8675ba74b90f42790175
SHA1 ae7f07096d74d1565929fffbf1a9711a08fc74e1
SHA512 99018c2cd0685bcfc6de8d08a649515b606982f56f1dced3b5304c7358e74bb463aa89795752580abff98b288865b49720940f8f0707a5f2527457edda968685
SSDEEP 24576:i3zB09p2zLmmibkFR8+mZi5r8BWhQumeMRvQt93dyQwuSXAkpbaUGQ74:i3y23mNbkFRJmQ58khQRT1QPtauSXAkA
TLSH
T19E4522D7A370DC7DDD530BB7929B40F4FD7A106B0AB2140A0627BD7A39257889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 f7c2e27bcdcda6092343664a604d7ab36682ca6f414ada54e7460d3d8075ffb4
MD5 063ffcbab5157b200dca0572d1b88fa6
SHA1 68d375fa027be4ccd4d63e95a9543674249ddaf9
SHA512 e3cfea905d0f20ddfa52c92154c95cbe7dd93501bf20b816f41d4270cc18cbfb0d0785ad3af4585a165288c3fed294d38cb8790372b9603fa912d5299d3c69a7
SSDEEP 49152:/LOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l1M:/qG2qe6JBKDtXmKjM
TLSH
T181C56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 fc89ea95f1ee9bcfa1009ebe315f22e4d7e0af73dd871a7e1a4219a93368cd36
MD5 95e8768750c2a89a5f0b377c1d8534ed
SHA1 a4f707cd63c9b5c92a1bdef3282b42b08227db59
SHA512 a74b711abc0925e395bf78c8f11841a16c11fc6a5d3a042628dd96756b7d7766bcb0499ee50ac6668ca7a75d4ab873e8decfc8fae21c59b78b6049ed46c974da
SSDEEP 49152:ALOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l1M:AqG2qe6JBKDtXmKjM
TLSH
T1DBC56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 632B
SHA256 9ad1e2c216c3c92a9f376a9b39148cc763b87e4f885d6b3cd47b25c9954caf52
MD5 41c488506e0828ad4b89524cbe4f813a
SHA1 ad22c5bc32a296b91adc3ac2b6a16d8bcea2ea78
SHA512 3cffbf3d75dd23a2db744933fa2089639cf36ccfac6c81294a63e755e0df6008554bc2f83ffc0eda51885bfeb24562e8b5d192e2cefc64267667509c18d660ab
TLSH
T14FF02DFF59D0657990F10BA1D03C63107CB205951B2B805846631F993B48F6DCA5DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll
Size 504KB
SHA256 f43b0edb510b4d7ba50b04242ff4f97a79c030c4b9978483b25171dffa3f868f
MD5 dced19feba5fa94f956070a91c5229f0
SHA1 afab9916b02500ae48c9144f2d3eb39dd4474c22
SHA512 847019bbc64b3c82468d06a5b7b8af2d8978664f53bd02265cde0a3d76430bb0ae8ac8053db9e0612261af587baf3389aec7a73a1fc2d1c7376f8f4382e4b341
SSDEEP 6144:RF1o4DAf5s1KStUkNbhk7Ak7KhPCcgoF0NKzdgbsQr7rVGCXox5:71o405CtUkBZk7K9CcgG0NWd/QDVGt5
TLSH
T11EB48E15B3E94AACE07AC134CA438547EB7178460B61F6DF02E0A2792F77BE45B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll
Size 7.5MB
SHA256 96d95fdb0e7a5540f4653dbeb4432c862de0644e46b9211a5122f36887e2ea2c
MD5 079bae06411aa3d1d4328b364aa9e5fd
SHA1 c70e47f6f82925e06c236cb9f76592a568516aad
SHA512 adfe1c14bd760199a2277f2c3f96af9aeb132426ea4bcb405fefc638fd84c7e52e93940050653a4e6a6a4ce6ed307360480671da389a48c30c72427aae60e0e6
SSDEEP 49152:ctvLjzlN4kFextqcusm4nHcpOjwrMQOT6n1SSCOQESgswJYgZc+5GTSpWy4EWT5N:aWusNpjgKle2S+E8Nkpp0ve9fPzFm
TLSH
T1DF867C13F69240DDC01DE2B8975B9223F778B8450764B2CF2A5453162FBAFE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Size 577KB
SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
MD5 2a1964ff31c7edff17f4c74d26fce378
SHA1 2c66f52ac23828ec6a18a6720ebfcb275482edcb
SHA512 fbb19f906ab8f61461c8be80d53a7cadddfe81524918171c0bfab45f9cec2f5c045ff7ff864858f5c087d4b05c585ba58dfdb7565302605efc524f388c241ba0
SSDEEP 6144:WpcHQYHQbmpKwey1WMmHfYOMg/jSxMP9sQqblfaYQhp1BPOjnng98//gwb:wwQKAGMDHfdgM6Qqbgaj+wb
TLSH
T117C42B1FF744122A05A352A27F099562FF32D06CA35112663CBD812C3376B6693BB7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Size 16KB
SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
MD5 8ce43bf0bee69290545738ae472bd5dd
SHA1 bbc36343250fa8bb2122c8af9e021fc80c032a0b
SHA512 67825fdb6c0381b7e35c73221caf37374157c1333388d0d20685f4d732340f7fc04faba29ae266fcaa921fff2694b5f8ca0ba24fbbdce2146189924e354df7a5
SSDEEP 384:5rg5RkIUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/neqA9oz+EFRUeLq4+lLbK74Tdu/:kgOXqEXqP
TLSH
T1DC72B89F1B21CA38E637477F6A5E3125EB3B805C4F91953419BBA44823C639603F71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-Hant.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
Size 16KB
SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
MD5 d41d181d619aef4a1af14bcd6ad2fc1c
SHA1 05ea268a59c887a92387a2ad2925285901bba1ba
SHA512 b2ed7c0c97672411266ef55cfed4e98a7d812e85a20706140c8ea8c566677ed9bdcfaac7d0656496e34db5a7a50e0c9e810fe9a18c2039630745ce617513b605
SSDEEP 384:pFTaUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/na5k+0SyIqLvsZXPuD:LxOXq+LBDXPuD
TLSH
T15E72175B1932CE38D5378B7E5B9F3624E63B612C5ED164342BEFB41423C636A16E2053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Size 17.8MB
SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
MD5 c6c9a3d440e436b8c28867f3c3955ce9
SHA1 208847cb98181e6ba434dd5ec17d686824604946
SHA512 2e1d53d773f57cf8c311674d60615602670d44af7a7545c60172ebbd47d6bb32e382c4cc91a5394fc1a51dab4b654be822f81f1ea963ec1176624b0bea6a6f1a
SSDEEP 393216:pqX9UazcYdpnzyXm++SSSCZMwh56qAgbITfTK3l76TmkrqjFWBm0iw+X:pqtJzcYnzoN+wCW4AAITG3lVkMgmeI
TLSH
T10A17124BA758562BCE3F07B74652563F373091197F835307209283281C6A7FBAD8DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Size 16.5MB
SHA256 cd98f7abc00a5ceed8e469d214eb3720c37bc6b89fdd1c15068e0788fbcb57d7
MD5 3eae2436f337b21b0db931a33f00eb20
SHA1 8473e335db8c4be55db8cac57605270654a939b3
SHA512 9529dedc4fdf681840897d7590eaa7cae10f8a41048daafa4719e8755ab0a802f4f10b97953d01603ca17a170c70110db13ce9a48a5b1c8ca3da301af08d81aa
SSDEEP 49152:lPK4h4NBgMkdzojU25zTPVigZn+fDNGKqrDdWJIlyAk0TH:BIlyPQH
TLSH
T147074680E7F95348F2F77F65EEBA90564836BE96ED29C75E0405050E0831A4C99BAF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Size 5.2MB
SHA256 d5ec433bd5d74a2da0070f87951547b13f371ed624c5502522834709015d0a2b
MD5 489aafba97063499ba51fc4862af4f6a
SHA1 f233b8db93f4a5348e04065a4ebe6e5e3a67f930
SHA512 a42ef36d8acc252f2dc0603f00cbea85fbfb2a63fdfdb32c2e18d99371f7d27104d3e101dfd2c5e8406630304f712c0cd3ca206155505da418ab0dc82fd491d7
SSDEEP 98304:m4ydZOjlb3GaE1COMOIFGOOOOOOOOOOOOqLOOOOOOOOOOM:FlC09GOOOOOOOOOOOOqLOOOOOOOOOOM
TLSH
T1AD463803F19680E9C06DD579875EA623B632F8840B3676DF66A00F1A2E79FE0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC3102C9B5CA2435C9733B42A876FDF0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jkurghm1\CSC3102C9B5CA2435C9733B42A876FDF0.TMP
Size 652B
SHA256 76d7c75154536d9287c63e401cdf4e118a91d01c6932ec1b9d77cc1c4337077d
MD5 f53293a6591b5d7e54ac8517e96f6b8e
SHA1 072887bd267ad49cf4705c2fc0993e685b5a3163
SHA512 ff701631f46fd09a72fd932f94cb8b4ebc0cbcdeb3c9e3ecebfcaeac3064cedcc842a17e77bb44139556512dc5141a8e6cc3d153dff98a56ea192622a424b26f
TLSH
T144F05E09A3FC020EF4F74B31BDF6436791A9BC65DE32A3ED1840031968746208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

jkurghm1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jkurghm1\jkurghm1.0.cs
Size 3KB
SHA256 f3b88de71f7d6b6f1e7b497bab8f0b5c073f5c4ec6d2e9724e8971b0fb270ddb
MD5 59e9c019e3b3bd032c6ebf09d6131e22
SHA1 bae4b1b5c90510e6fe3bdc3ff5567e41907c5dc8
SHA512 c8d0087191128647c441bd66803da541a74d3eca523109e2e2293b6a5d7435164a1db220e7ac3f502833811a59cbb5b0d6262ba810de1c26c999da75db86f5e4
TLSH
T1A861FC08259312268A53723C6B89210DB771F46713D8BF24BC2E1740EF6A07A97B4F9F
MD5 SHA1 SHA512 TLSH

Submit Download

jkurghm1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jkurghm1\jkurghm1.cmdline
Size 369B
SHA256 92cb15fd81678ba7c68506360f2374f432c330a5ba73587ed4f284aae690bd6c
MD5 f8b5d878f58847008ee7ba92f63ce5c9
SHA1 ae5485e61cbc63e9d1fc0c47ccaeeeab131cd5c5
SHA512 35f9bc85ca3c1579feb25d14990d0165851b3db53ff54e740d30ab399d71f0ca1fc91d7463009896ab58ef7cab639751ff49762fa926ff0bb2142c6b8f24112b
TLSH
T145E0C63B6247C27D02FD100B626AC4BDC2F20F833B843F84904088CDE12FA102BD2789
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2344-775-0x000002E0A0FF0000-0x000002E0A10C3000-memory.dmp

Download

memory/2824-514-0x00007FFCC9190000-0x00007FFCC9191000-memory.dmp

Download

memory/2824-527-0x0000022A8B940000-0x0000022A8BA13000-memory.dmp

Download

memory/2824-513-0x00007FFCC9180000-0x00007FFCC9181000-memory.dmp

Download

memory/4504-434-0x00007FFC9B020000-0x00007FFC9D866000-memory.dmp

Download

memory/4504-753-0x0000020B83170000-0x0000020B837F0000-memory.dmp

Download

memory/4504-723-0x00007FFC9B020000-0x00007FFC9D866000-memory.dmp

Download

memory/4504-435-0x00007FFC9B020000-0x00007FFC9D866000-memory.dmp

Download

memory/4844-27-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-25-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-42-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-40-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-39-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-430-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-407-0x000001E2AC540000-0x000001E2AC548000-memory.dmp

Download

memory/4844-44-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-37-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-36-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-28-0x000001E2C6280000-0x000001E2C6484000-memory.dmp

Download

memory/4844-30-0x000001E2C5340000-0x000001E2C536A000-memory.dmp

Download

memory/4844-32-0x000001E2C5290000-0x000001E2C5296000-memory.dmp

Download

memory/4844-33-0x000001E2C52A0000-0x000001E2C52AA000-memory.dmp

Download

memory/4844-35-0x000001E2C52F0000-0x000001E2C5316000-memory.dmp

Download

memory/4844-34-0x000001E2C52B0000-0x000001E2C52B8000-memory.dmp

Download

memory/4844-31-0x000001E2C4D40000-0x000001E2C4D48000-memory.dmp

Download

memory/4844-29-0x000001E2C5270000-0x000001E2C528A000-memory.dmp

Download

memory/4844-0-0x00007FFCA875F000-0x00007FFCA8760000-memory.dmp

Download

memory/4844-45-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-375-0x000001E2C5410000-0x000001E2C5422000-memory.dmp

Download

memory/4844-26-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-46-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-43-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-24-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-23-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-22-0x000001E2C5B40000-0x000001E2C6068000-memory.dmp

Download

memory/4844-21-0x000001E2C5440000-0x000001E2C5602000-memory.dmp

Download

memory/4844-20-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-18-0x000001E2C52A0000-0x000001E2C52CA000-memory.dmp

Download

memory/4844-19-0x000001E2C52A0000-0x000001E2C52C4000-memory.dmp

Download

memory/4844-17-0x000001E2C4D20000-0x000001E2C4D2A000-memory.dmp

Download

memory/4844-16-0x000001E2C51B0000-0x000001E2C5262000-memory.dmp

Download

memory/4844-15-0x000001E2C4D00000-0x000001E2C4D1E000-memory.dmp

Download

memory/4844-48-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-374-0x000001E2C52E0000-0x000001E2C52EA000-memory.dmp

Download

memory/4844-12-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-11-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-10-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-9-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-8-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-7-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-6-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-5-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download

memory/4844-4-0x000001E2C4B30000-0x000001E2C4B52000-memory.dmp

Download

memory/4844-1-0x00007FFCA85D0000-0x00007FFCA8F74000-memory.dmp

Download