e865f378e587de84cc26caa5f48ffd4dc74e4e20613cddbc24b5e2f03bdfc70b

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
saviour_crack.exe
Size 1.2MB
Sample260731-a8psmatvcx
SHA256 e865f378e587de84cc26caa5f48ffd4dc74e4e20613cddbc24b5e2f03bdfc70b
MD5 1c69b97f678ebfd21c8ce73160a7ca44
SHA1 ce6677d3ad209424e66d42911fc100eb1ebdd8dd
SHA512 8af922a54cbda5529769261997636d784d1bac26cec3027e019fd6155fb5861ffc3d5ae17f069f7791756cbe7d54e651b88429e90fd9cc23654ed19567ab130b
SSDEEP 12288:J1hE8IcXrz8P48TTxpYpQFM4oTGLiUJygnAAoa52AB7DTSFi14jv:J128nXroP485pYpQK4oqLf08Mv
TLSH
T1B3555C895B28D6AEE363D17D4021D139E6717C220FD1924A42F9A2FC1E7B334796BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --autostart --minimized"	Spotify.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	960	saviour_crack.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Spotify.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 10 IoCs

pid	Process
1304	SpWebInst0.exe
3700	Spotify.exe
220	Spotify.exe
4852	Spotify.exe
544	Spotify.exe
4888	Spotify.exe
3816	Spotify.exe
4768	Spotify.exe
4220	Spotify.exe
1132	Spotify.exe

Loads dropped DLL 31 IoCs

pid	Process
3700	Spotify.exe
220	Spotify.exe
3700	Spotify.exe
3700	Spotify.exe
3700	Spotify.exe
544	Spotify.exe
4852	Spotify.exe
4852	Spotify.exe
4888	Spotify.exe
4888	Spotify.exe
4888	Spotify.exe
4852	Spotify.exe
544	Spotify.exe
4852	Spotify.exe
4852	Spotify.exe
4852	Spotify.exe
4852	Spotify.exe
3816	Spotify.exe
3816	Spotify.exe
3816	Spotify.exe
544	Spotify.exe
544	Spotify.exe
4768	Spotify.exe
4220	Spotify.exe
4768	Spotify.exe
4768	Spotify.exe
1132	Spotify.exe
1132	Spotify.exe
1132	Spotify.exe
1132	Spotify.exe
4768	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
544	Spotify.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Spotify.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Spotify.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Spotify.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.launcher\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.client\DisplayName = "Spotify"	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.launcher\CustomActivator = "{18A68F64-72DD-42CE-A75D-EDBDAC226F5D}"	SpWebInst0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.client\CustomActivator = "{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}"	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.client\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.client	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.launcher	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\spotify	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.launcher\DisplayName = "Spotify Launcher"	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" -ToastActivated"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\spotify\shell\open	Spotify.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3700	Spotify.exe
3700	Spotify.exe
3700	Spotify.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe
Token: SeShutdownPrivilege	3700	Spotify.exe
Token: SeCreatePagefilePrivilege	3700	Spotify.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3700	Spotify.exe
3700	Spotify.exe
3700	Spotify.exe
3700	Spotify.exe
3700	Spotify.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3700	Spotify.exe
3700	Spotify.exe
3700	Spotify.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1304	960	saviour_crack.exe	95
PID 1304 wrote to memory of 3700	1304	SpWebInst0.exe	96
PID 3700 wrote to memory of 220	3700	Spotify.exe	97
PID 3700 wrote to memory of 4852	3700	Spotify.exe	102
PID 3700 wrote to memory of 4852	3700	Spotify.exe	102
PID 3700 wrote to memory of 544	3700	Spotify.exe	103
PID 3700 wrote to memory of 4888	3700	Spotify.exe	104
PID 3700 wrote to memory of 4888	3700	Spotify.exe	104
PID 3700 wrote to memory of 3816	3700	Spotify.exe	106
PID 3700 wrote to memory of 3816	3700	Spotify.exe	106
PID 4768 wrote to memory of 4220	4768	Spotify.exe	112
PID 3700 wrote to memory of 1132	3700	Spotify.exe	113

C:\Users\Admin\AppData\Local\Temp\saviour_crack.exe
"C:\Users\Admin\AppData\Local\Temp\saviour_crack.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe /INSTALLCOMPLETE
    3⤵
    - Adds Run key to start application
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.94.583 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffbf7ed5448,0x7ffbf7ed5454,0x7ffbf7ed5460
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:220
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2212,i,17585982088760486352,3652780464099738567,262144 --field-trial-handle=2344,i,6378180522907293005,11256089556521237952,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2352,i,11697327761930825771,11744902774860443855,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2356 --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4852
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --metrics-shmem-handle=2684,i,12503869910298257003,16951805905853290231,524288 --field-trial-handle=2344,i,6378180522907293005,11256089556521237952,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2352,i,11697327761930825771,11744902774860443855,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2704 --mojo-platform-channel-handle=2700 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Time Discovery
      PID:544
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --metrics-shmem-handle=2924,i,6452459364006147643,2569363596522884984,524288 --field-trial-handle=2344,i,6378180522907293005,11256089556521237952,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2352,i,11697327761930825771,11744902774860443855,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=3052 --mojo-platform-channel-handle=3048 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4888
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=6012,i,2386277310989833265,9086538579088964723,2097152 --field-trial-handle=2344,i,6378180522907293005,11256089556521237952,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2352,i,11697327761930825771,11744902774860443855,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=6024 --mojo-platform-channel-handle=6020 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3816
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --metrics-shmem-handle=7204,i,6858914912327344786,5248404599485825345,524288 --field-trial-handle=2344,i,6378180522907293005,11256089556521237952,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2352,i,11697327761930825771,11744902774860443855,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7552 --mojo-platform-channel-handle=7548 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1584

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.94.583 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffbf7ed5448,0x7ffbf7ed5454,0x7ffbf7ed5460
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9aa9c27f-23a8-498e-9682-1bc9f2ec8639.tmp

Path C:\Users\Admin\AppData\Local\Spotify\Browser\9aa9c27f-23a8-498e-9682-1bc9f2ec8639.tmp
Size 9KB
SHA256 98a2b8af7b532be9a8baa7d4fbb0e7bdf1bf8d4662ffac9f69434c5245011976
MD5 30a44f4dc9613008a905457ec4d9bb29
SHA1 2444ec566ead9be5d86ce4d671506d784fc10a80
SHA512 3d7d46ef7b267d18d13066a4bb1e59f409a40eaaa3484fb2e65b5ca64bdf6ae2c7038c90d4a4dd61d183b640ce83cf1c590c4cc6ad97ac074dcee68b08c53692
SSDEEP 192:zRrZE+2v7Sp4gXcb+WNV878Qd8/s6ZrR0yIsn2KgR:zRlE+C0XgjZCR
TLSH
T19C12841FA964A53B6DC7D62AF9243797E2F60025B5942D48D7FC862C26D76CC232380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

cf520934-5da2-4f08-9ca2-26e18c26c119.tmp

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\cf520934-5da2-4f08-9ca2-26e18c26c119.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
Size 9KB
SHA256 88f8feeddf65de819966b2066f5618543d067dc2313722b285c832102d4f52a6
MD5 53371e0a829fde57cd893ee52eafdd43
SHA1 9b9044248f3d7d11280d7433703374cf62d24de7
SHA512 b235e4b55a6b5fec3ed2462b77677ae67b2130f53ddc157aa164de83b3cd13a87950a01bf79845cdd55029fbefdb27e1738e6b09a17f07c36e98d793a86ee7fe
SSDEEP 192:zRrZEi92v7Sq4g9HHcb+WNV878Qd8/s6fF3R/yIsn2KgR:zRlE+CPVgjd3vR
TLSH
T1DA22841FA920A87B5DC7D62AF9243797E3F60025B5946D44D7FC8A2C26D76CC232381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
Size 10KB
SHA256 d9b80c541a6403f6da06ad92aea4bbe15e686696f576741e4ec9820c8edf1c40
MD5 5c75e2f508788b637e744187849aeff8
SHA1 6a258fc48ae38164fd206bf8ed13b6658735af5c
SHA512 729e53fa2cb0ce2e1c5912b6ec1daca6da6deda90367433e957d0e9c518876587d5e27009aba457da8da5ecbf5b3b0f8443062ad3078bba914cf940847095006
SSDEEP 192:zRrZEi9Wv7Sq4g9HHcb+WNV878Qd8/s6fF3R/yIsn2Kgu:zRlE+iNVgjd3vu
TLSH
T1F222942FA920A57B6DC7D62AF9247797E2F60025B5906D44D7FC8A2C26D76CC231380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
Size 8KB
SHA256 3e667f51cd1d5a604b8923de470fa324ad42a23912a42fddb99e403bdabe2e96
MD5 b738d558c6f242779e491cf5af8cb363
SHA1 c4840e1688fdc0c29e640fb1bfc4ed35442a19b1
SHA512 1f144894029032d048e9720e22ee92f2ffcd257980df8af6af0ce62a598b5f44271265d311cb5e906c2d4eaa60e6de907a566830365cc9976e9875f6a2f2d97a
SSDEEP 192:zRJB3uqoQv7AIn9hHcb+WNOWFU/yIsn2Kgj:zRJB3YMv7gdGj
TLSH
T10E02852EA824957BACC6E759F9257B82F3F5102175943D48D7F8CA2C28D7ACC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
Size 8KB
SHA256 3c3955a446dba4af66a078bd68c39a23e9aef010528d1466731c1216a3bb17a2
MD5 b7623f936de3b7183f54dc58c257305a
SHA1 5a0a9c21ca34bee09864b7b7ef6fcba1540c48a4
SHA512 4b98bae72208f0131f92e432ae66d99ce90bd63cf40f108cfea633545c7e1e6c8393fa74a6ccf0cdf9cb71b82fa146c30421fde26111f9fbc1c87ebe847d3b65
SSDEEP 192:zRJB3uqoQv7cIn9hHcb+WNOWFU/yIsn2Kg8:zRJB3YMz7gdG8
TLSH
T1E102742EAD24997F9CC6E76AF9253782F3F5102175943D48D7F88A2C28D7ACC122741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a0512.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe5a0512.TMP
Size 7KB
SHA256 2eef0bac06ad34b378d3dd2373c8a01e3225bfc958178efb7da5f8da8720c8c6
MD5 ad97d83c0be97623fe55a6a7f624e5ba
SHA1 50a7507884971d771379d14d5495c4f79205e637
SHA512 4df4b3b7ea4a58dd9ffaad4dddf8b5a923fcb7a6a42eff7f3810c25a2abf429ddaf960fb925d1aab6513c0daa947ee2c9077302fdf4cca4141ddd420dbb0ffce
SSDEEP 96:zRqjuvIoz38oodxwtv76dKWCLwAeuX796b+WVoMPktNm+Tem9jnK86SbNLCyIsnx:zRPB3LoQv7cInXcb+WNO4Q0yIsn2Kg8
TLSH
T19BF1852EAD24957F5CC6E72AF9257782E3F6102175943D48DBF8892C28D7ACC223741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Spotify\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 3KB
SHA256 6b71559c171cb69738c7e472198ce53010939861340ef251dc7f1f2ff3a55494
MD5 2523724f603d53157c90ccd815f61ca8
SHA1 375784c781fe9820d6ae67065882482d2046aa6e
SHA512 2b0b0c6a4555afbea8e2c854d1ff81ebef6efe94df54de46d69717a22eda99495baefa33138095b9e371a0e887da92237c63f53a12f9142fad033fecefbf819c
TLSH
T18D61A526A4A4CD7329BBE452B9022A83EB792023E2647FD8E6FD4F0C05EB1DC1343517
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 6KB
SHA256 e4bfd598e87b7265972f0813d59cda506e8ed0897fb472606cbc9f111c4177a4
MD5 c0c55f98fbd35655b51ce6a587cd582e
SHA1 b31ad04542499280743f2e800f4e35df69b1ad72
SHA512 6ac2e1308a8c0edc960b3d6741d09b1b47dd7646ab077d3daa5ded626f4bb40e9b96bed0e2c7d50987cf87a47fac70dbc73abc61ced4472ecf0af21d4f0e5250
SSDEEP 96:bRbJ61pZfnvO6NF+Dotoh+DotoyN5D6DEB6CGyv8tnOI/7kjtMyf+WJHS7NTdleI:lt4FvO6+DUxDUBgoiXS28of
TLSH
T125D1923AE4CACE77ECEF95E2220376E7FB64122656845AC49DD54E0C04CF5EE320681E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 3KB
SHA256 7c7ee751debbf0dc623e73b1510da73554216e6d385696cb0eee87e9a87ad4a5
MD5 620ca8aa30e6005183d1f314218ad2f8
SHA1 58d95b53c6611ca414fa24a5bac130e8ed6d4705
SHA512 46a7e2fa44e4b7b7b40c597a707a40b5c7206609f52e69bc241d729843a3412602f3aad65b8925ad7c3a01048d348e93824b3be106b4998339143c25e23334c2
TLSH
T15B61A62694A4CD7729B7E452B5422A83EB791123E2647FD4E6FD4F0D01EB1EC1343917
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5992a1.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe5992a1.TMP
Size 1008B
SHA256 35e40864db5604a3af74221fbe91932b00e8541019bfdb82fdef7fe95e2ccb36
MD5 e6182f687e9424d908ec322d2852474b
SHA1 d14db95392b80694d728af606cc2382a7e1d0781
SHA512 bd7fc187dbfd4863e808f64cd3a28c2ea0a07351a0caba0f3857ae8c53cf9db8bbcd58f60669185816c7f6cbbbbc91b7b939d2d300697afdd0d0f44b0b0887e6
TLSH
T13211217294402EB17ED6A2A67346E7C31F36113381555A8823DB570602A7128522BC76
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Size 56B
SHA256 20eb1024d22f9d09ce22c76f1631ebd571a76ed58a20dd862a955a7dfe75743b
MD5 6957b6fd90aadef3e3891a8961f6d6cb
SHA1 fe857d415197a9c65ef2189bb272381e5ffc995a
SHA512 5cfd1a373842f7498f9f42f2824f9b7186e335048904105c1f7082e7d9c83f07e906f983596b2924a930b28761c1cd61d64c90984764c211db484fedb67dcf81
MD5 SHA1 SHA512

Submit Download

a913b868-9744-48c7-bfad-4d5495b7169d.tmp

Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\a913b868-9744-48c7-bfad-4d5495b7169d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
Size 3.9MB
SHA256 8bacdfd42f45f62451bed32a0bd9275e4e1aaf732d742acfaf3f8879b93a9a32
MD5 d322f6d9b607c6439807ff94f0233686
SHA1 98c031f7a404a38972cde17bf49b9eeb43f9ca39
SHA512 d43aae288aa2ac8d1adafd67d33c2b7373af45f6069b8d620deee4da861b5d6d0da4e849bb62976ebe8160d2fbdd6d856d165cd5e39c70ee3747763a3a023685
SSDEEP 98304:kTBUyjse9mf8YJNURr4miCQ6AuHdVMSQzEbLNtxqMUQkZ:kddF9mfPg4aHdVAzEbr4MO
TLSH
T1F316333882F519C5C92E0E30C5AD0B69E2A21CD30912EFB6BD5591F70E4A1C7EFF9529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.2MB
SHA256 0c827576c4394fa2cc7419867d147546a7ea82e52c577ddb9063a95806ea9b11
MD5 16291380ae636821b818ea4c201450c1
SHA1 9146fbbb2b2872ca712adf5f547d8503c5e0d29b
SHA512 afc765d9d70b08d87b1d90e73229fea674bfb7f0abf5005e2a82f06b17b9767887eb25a180ce6b1190e815cf78ead5e646fc2fda2f195d4facc48bfb3c7119a9
SSDEEP 393216:N76zmdtcytrFkaO5uORUdiPRt6RpdhzoG9W9o:PrBNhzjke
TLSH
T155979EAB71E401ADC0AEE1B9CB17DD17E7B7744A0732E34F02A082A21F67A60567F751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 89c308809a2a73cb63cea07d3dbe89a4e2aecf3440de29e6351e1355adcd85f3
MD5 6a9751a4b35d041341c53a15038bcfc8
SHA1 a54ab8d2bbdf846c9292f357676a90e6e085c8f1
SHA512 6d6bee861ec3cc1c59b988457c1ae45d29da1391dd6eb3fce53e219c673e6d90de4b24ff251c1096e42c93a3ca2fcaed6fa60faaf6f3cd8459143e07d68b4f1d
SSDEEP 49152:6HYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+di8:6HYg8xwfGrUA9Ncnas8jdJ
TLSH
T156D57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Size 705KB
SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
MD5 0321d6c44a6041910208ce3891727842
SHA1 42e8935bd94f0fa3fd8611fc84e25a06e8ba82ed
SHA512 6c9348ed4d50fb2503012b80c0dc8f4cf07d00d2ff857fff8c102266533e65befc6535998f9497fe414cd427dfaf0ff3e5cd1b586addba236b3794768e3d476c
SSDEEP 12288:bI3H1fJwhjzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnSzm5dVYJblIt6kjKQCrC:U3VBE7zEEmPL8bTe+gnSzm5d2bc6kGQt
TLSH
T1FCE412E77374AC7DEE9B1277826505B0FC371A681B82020A179BF8796913B48D8C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Size 1.2MB
SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
MD5 d995543b367f8675ba74b90f42790175
SHA1 ae7f07096d74d1565929fffbf1a9711a08fc74e1
SHA512 99018c2cd0685bcfc6de8d08a649515b606982f56f1dced3b5304c7358e74bb463aa89795752580abff98b288865b49720940f8f0707a5f2527457edda968685
SSDEEP 24576:i3zB09p2zLmmibkFR8+mZi5r8BWhQumeMRvQt93dyQwuSXAkpbaUGQ74:i3y23mNbkFRJmQ58khQRT1QPtauSXAkA
TLSH
T19E4522D7A370DC7DDD530BB7929B40F4FD7A106B0AB2140A0627BD7A39257889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 10cb24ce6ee9aaa217edc260dc73b640e2b77979de0e81596f471882e50eae24
MD5 4cae7b28dce3ce72dacb3953877038fa
SHA1 32a76c6073b0b163ef4a52b9e96e8e5ac46fa2b4
SHA512 6691cfae044a6ea0fd12b42ef3053b37ff12e12d5f234d8d64baf47cf58d13bf7264474072cf9d43219a87ec13f568290f15785007ed093fb46c63e5e6a66a64
SSDEEP 49152:hLOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l1i:hqG2qe6JBKDtXmKji
TLSH
T1F5C56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 632B
SHA256 aac028b09673d950449a7cc421340caecd1ef07b88e298eeef3e01b742050628
MD5 28d2dafc9d62283cdeb8cd72236285ac
SHA1 504184306fed528cde3dd324c3882a661fea0589
SHA512 50ca4543b0b221e0fea3c5ae56156186603776241c5feeee9a7b4a99364887ce27dc989e56121199fe0ae32f93e5b905302f6dff370bd7f24485f124d1719ee3
TLSH
T1F3F02DFF59D065B9A0F10BA1E03C63107CB205951B2B805846531F993B48F69CE5DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
Size 4.5MB
SHA256 25ac2951a586975948e636965fd3ff1900a1177ef47b67460dd80519a441a542
MD5 316d00a8ff72656707c85d6881925f2e
SHA1 b286845913d5dfd13357e4b544c0325bfdf8d02a
SHA512 ae51f619e871236fb8fa4c89fb1d795157b0fb35c26af9acca54c21c569caa328e6b685e6391e70d57a5c0c98af9d824b43e410d4a68b44f7c651d8d319ce06b
SSDEEP 49152:USHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:PuktcrfNlTyj5byqSm
TLSH
T1DC268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
Size 504KB
SHA256 36644508c8dd408bf7eef9bdbeea3ecc5f4b96eace43ba42161b2c9fe770c8e4
MD5 bee922c7cef11d71a3a400daa06096f8
SHA1 bbc0308d86a5659d0b7afdd8592d89463f0ec44b
SHA512 3a31e3b32c351d8075e48f778f795afcf74291c3f62f5251aa791a5c0832dbc2405b828d78f5a254a435b5d88cc91dbbf4844d70efaf698ef69d1cfa93c4c5dc
SSDEEP 6144:UF1o4DAf5s1KStUkNbhk7Ak7KhPCcgoF0NKzdgbsQr7rVGCXoxk:o1o405CtUkBZk7K9CcgG0NWd/QDVGtk
TLSH
T11BB48E15B3E94AACE07AC134CA438547EB7178460B61F6DF02E0A2792F77BE45B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
Size 7.5MB
SHA256 9bea677e29c8a05c16ed0777d3aac5ea20091bbf8f3c98755dbf1ab00e9ec876
MD5 b6af5f0bd69286e098f2c3de73e4c793
SHA1 8fddd83b0e327273f58734c470b14fa38aabf13f
SHA512 1463576e18e7ce62594d1c6a7e82e1ec469ecef2aa37be8518c92d966a306f10245c481d1f27374c024d3db892e520669bf092b9c3551b7fbea27117d41a29a9
SSDEEP 49152:3tvLjzlN4kFextqcusm4nHcpOjwrMQOT6n1SSCOQESgswJYgZc+5GTSpWy4EWT51:9WusNpjgKle2S+E8Nkpp0ve9fPzFC
TLSH
T12A867C13F69240DDC01DE2B8975B9223F778B8450764B2CF2A5453162FBAFE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Size 577KB
SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
MD5 2a1964ff31c7edff17f4c74d26fce378
SHA1 2c66f52ac23828ec6a18a6720ebfcb275482edcb
SHA512 fbb19f906ab8f61461c8be80d53a7cadddfe81524918171c0bfab45f9cec2f5c045ff7ff864858f5c087d4b05c585ba58dfdb7565302605efc524f388c241ba0
SSDEEP 6144:WpcHQYHQbmpKwey1WMmHfYOMg/jSxMP9sQqblfaYQhp1BPOjnng98//gwb:wwQKAGMDHfdgM6Qqbgaj+wb
TLSH
T117C42B1FF744122A05A352A27F099562FF32D06CA35112663CBD812C3376B6693BB7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Size 16KB
SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
MD5 8ce43bf0bee69290545738ae472bd5dd
SHA1 bbc36343250fa8bb2122c8af9e021fc80c032a0b
SHA512 67825fdb6c0381b7e35c73221caf37374157c1333388d0d20685f4d732340f7fc04faba29ae266fcaa921fff2694b5f8ca0ba24fbbdce2146189924e354df7a5
SSDEEP 384:5rg5RkIUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/neqA9oz+EFRUeLq4+lLbK74Tdu/:kgOXqEXqP
TLSH
T1DC72B89F1B21CA38E637477F6A5E3125EB3B805C4F91953419BBA44823C639603F71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-Hant.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
Size 16KB
SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
MD5 d41d181d619aef4a1af14bcd6ad2fc1c
SHA1 05ea268a59c887a92387a2ad2925285901bba1ba
SHA512 b2ed7c0c97672411266ef55cfed4e98a7d812e85a20706140c8ea8c566677ed9bdcfaac7d0656496e34db5a7a50e0c9e810fe9a18c2039630745ce617513b605
SSDEEP 384:pFTaUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/na5k+0SyIqLvsZXPuD:LxOXq+LBDXPuD
TLSH
T15E72175B1932CE38D5378B7E5B9F3624E63B612C5ED164342BEFB41423C636A16E2053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Size 17.8MB
SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
MD5 c6c9a3d440e436b8c28867f3c3955ce9
SHA1 208847cb98181e6ba434dd5ec17d686824604946
SHA512 2e1d53d773f57cf8c311674d60615602670d44af7a7545c60172ebbd47d6bb32e382c4cc91a5394fc1a51dab4b654be822f81f1ea963ec1176624b0bea6a6f1a
SSDEEP 393216:pqX9UazcYdpnzyXm++SSSCZMwh56qAgbITfTK3l76TmkrqjFWBm0iw+X:pqtJzcYnzoN+wCW4AAITG3lVkMgmeI
TLSH
T10A17124BA758562BCE3F07B74652563F373091197F835307209283281C6A7FBAD8DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Size 16.6MB
SHA256 92b2d6a0950ba7d39333229b2c1ea8825042acc8c9bad12bb1bcf01db24bad56
MD5 fd631dc137d6e668da674350e76b1442
SHA1 e7c210b6fe36f264d42cd94438e4ff9defae178d
SHA512 6db0044980b403b365072d8417f20267b4fc5eb640883777461496050e0ddb69d4890e9965d149b72335f19840d0804ffedfeaee2ec50b3c13d6dc8adff3c6a2
SSDEEP 49152:PMK4h4UrzskpzKDURNdmbViebnI/StH0qCXxt/3wB+p0Hbuvu:ep0Hy2
TLSH
T18C074680E7F95348F2F77F65EEBA90564836BE96ED29C75E0405050E0831A4C99BAF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Size 5.2MB
SHA256 950cc641d85ee7239a7c95fa8e5f4118491ed996abd34de10b8c5f21db3dbdd9
MD5 d29b2ec8ab4c97e1d807c33d9aabfc7b
SHA1 d8fdedba0b7cd7fa9b3b66d15356292c71579c59
SHA512 e0db14c9870c488d4e072a3a2ae47fafcc14291c8344946009ce0708e0553b53d063e20a20cf224674e02f602ab50f7d1825c15096b43a5d5bdcc0030a49f465
SSDEEP 98304:v4ydZOjlb3GaE1COMOIFGOOOOOOOOOOOOqLOOOOOOOOOO6:YlC09GOOOOOOOOOOOOqLOOOOOOOOOO6
TLSH
T107463803F19680E9C06DD579875EA623B632F8840B3276DF66A01F1A2E79FE0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3700-651-0x00007FFBF5410000-0x00007FFBF7C70000-memory.dmp

Download

memory/3700-550-0x00007FFBF5410000-0x00007FFBF7C70000-memory.dmp

Download

memory/3700-339-0x00007FFBF5410000-0x00007FFBF7C70000-memory.dmp

Download

memory/3700-337-0x00007FFBF5410000-0x00007FFBF7C70000-memory.dmp

Download

memory/4852-551-0x0000020ADA260000-0x0000020ADA6ED000-memory.dmp

Download

memory/4852-713-0x0000020ADA260000-0x0000020ADA6ED000-memory.dmp

Download

memory/4888-377-0x00007FFC14C50000-0x00007FFC14C51000-memory.dmp

Download

memory/4888-376-0x00007FFC145F0000-0x00007FFC145F1000-memory.dmp

Download