e865f378e587de84cc26caa5f48ffd4dc74e4e20613cddbc24b5e2f03bdfc70b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
saviour_crack.exe
Size 1.2MB
Sample260731-a8psmatvcx
SHA256 e865f378e587de84cc26caa5f48ffd4dc74e4e20613cddbc24b5e2f03bdfc70b
MD5 1c69b97f678ebfd21c8ce73160a7ca44
SHA1 ce6677d3ad209424e66d42911fc100eb1ebdd8dd
SHA512 8af922a54cbda5529769261997636d784d1bac26cec3027e019fd6155fb5861ffc3d5ae17f069f7791756cbe7d54e651b88429e90fd9cc23654ed19567ab130b
SSDEEP 12288:J1hE8IcXrz8P48TTxpYpQFM4oTGLiUJygnAAoa52AB7DTSFi14jv:J128nXroP485pYpQK4oqLf08Mv
TLSH
T1B3555C895B28D6AEE363D17D4021D139E6717C220FD1924A42F9A2FC1E7B334796BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spotify = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --autostart --minimized"	Spotify.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	4060	saviour_crack.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping5968_165106462\privacy-sandbox-attestations.dat	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping5968_165106462\manifest.json	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping5968_165106462\_metadata\verified_contents.json	Spotify.exe

Executes dropped EXE 11 IoCs

pid	Process
6008	SpWebInst0.exe
5968	Spotify.exe
3708	Spotify.exe
4816	Spotify.exe
5936	Spotify.exe
3220	Spotify.exe
4396	Spotify.exe
4444	Spotify.exe
2744	Spotify.exe
2848	Spotify.exe
5484	Spotify.exe

Loads dropped DLL 34 IoCs

pid	Process
5968	Spotify.exe
3708	Spotify.exe
5968	Spotify.exe
5968	Spotify.exe
5968	Spotify.exe
4816	Spotify.exe
4816	Spotify.exe
4816	Spotify.exe
5936	Spotify.exe
3220	Spotify.exe
3220	Spotify.exe
4816	Spotify.exe
5936	Spotify.exe
3220	Spotify.exe
4816	Spotify.exe
4816	Spotify.exe
4816	Spotify.exe
5936	Spotify.exe
4396	Spotify.exe
4396	Spotify.exe
5936	Spotify.exe
4396	Spotify.exe
4444	Spotify.exe
2744	Spotify.exe
4444	Spotify.exe
4444	Spotify.exe
4444	Spotify.exe
2848	Spotify.exe
2848	Spotify.exe
2848	Spotify.exe
2848	Spotify.exe
5484	Spotify.exe
5484	Spotify.exe
5484	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5936	Spotify.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Spotify.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\Spotify.desktop.client\CustomActivator = "{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}"	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\Spotify.desktop.launcher	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\Spotify.desktop.launcher\CustomActivator = "{18A68F64-72DD-42CE-A75D-EDBDAC226F5D}"	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\Spotify.desktop.client	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\Spotify.desktop.client\DisplayName = "Spotify"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\Spotify.desktop.launcher\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\Spotify.desktop.launcher\DisplayName = "Spotify Launcher"	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" -ToastActivated"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\Spotify.desktop.client\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\spotify	Spotify.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	Spotify.exe
5968	Spotify.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe
Token: SeShutdownPrivilege	5968	Spotify.exe
Token: SeCreatePagefilePrivilege	5968	Spotify.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5968	Spotify.exe
5968	Spotify.exe
5968	Spotify.exe
5968	Spotify.exe
5968	Spotify.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5968	Spotify.exe
5968	Spotify.exe
5968	Spotify.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 6008	4060	saviour_crack.exe	90
PID 6008 wrote to memory of 5968	6008	SpWebInst0.exe	91
PID 5968 wrote to memory of 3708	5968	Spotify.exe	92
PID 5968 wrote to memory of 4816	5968	Spotify.exe	94
PID 5968 wrote to memory of 5936	5968	Spotify.exe	95
PID 5968 wrote to memory of 4816	5968	Spotify.exe	94
PID 5968 wrote to memory of 3220	5968	Spotify.exe	96
PID 5968 wrote to memory of 3220	5968	Spotify.exe	96
PID 5968 wrote to memory of 4396	5968	Spotify.exe	98
PID 5968 wrote to memory of 4396	5968	Spotify.exe	98
PID 4444 wrote to memory of 2744	4444	Spotify.exe	104
PID 5968 wrote to memory of 2848	5968	Spotify.exe	106
PID 5968 wrote to memory of 5484	5968	Spotify.exe	109
PID 5968 wrote to memory of 5484	5968	Spotify.exe	109

C:\Users\Admin\AppData\Local\Temp\saviour_crack.exe
"C:\Users\Admin\AppData\Local\Temp\saviour_crack.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe /INSTALLCOMPLETE
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.94.583 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ffe2e655448,0x7ffe2e655454,0x7ffe2e655460
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3708
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2160,i,15269942258619988442,8362491331880385868,262144 --field-trial-handle=2488,i,5352347245275659673,4781712210092871587,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2492,i,11954515687910221790,6457319656658309310,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2500 --mojo-platform-channel-handle=2484 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4816
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --metrics-shmem-handle=2396,i,16692034780623190416,8937421349190923776,524288 --field-trial-handle=2488,i,5352347245275659673,4781712210092871587,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2492,i,11954515687910221790,6457319656658309310,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2532 --mojo-platform-channel-handle=2528 /prefetch:11
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Time Discovery
      PID:5936
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --metrics-shmem-handle=2904,i,6509039117931317664,18180807191519133378,524288 --field-trial-handle=2488,i,5352347245275659673,4781712210092871587,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2492,i,11954515687910221790,6457319656658309310,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=3096 --mojo-platform-channel-handle=3092 /prefetch:13
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3220
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1785458619118616 --launch-time-ticks=667058494 --metrics-shmem-handle=6088,i,245502177286161325,4359346891423684716,2097152 --field-trial-handle=2488,i,5352347245275659673,4781712210092871587,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2492,i,11954515687910221790,6457319656658309310,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=6136 --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4396
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --metrics-shmem-handle=7568,i,380925185494343151,18118192375695378245,524288 --field-trial-handle=2488,i,5352347245275659673,4781712210092871587,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2492,i,11954515687910221790,6457319656658309310,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7536 --mojo-platform-channel-handle=7532 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2848
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.583" --metrics-shmem-handle=6784,i,17827481164430997946,6672364810109913877,524288 --field-trial-handle=2488,i,5352347245275659673,4781712210092871587,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2492,i,11954515687910221790,6457319656658309310,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=6948 --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2652

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.94.583 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ffe2e655448,0x7ffe2e655454,0x7ffe2e655460
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4f077a24de1dc2aa0c8060d3e1624e0ca5a6bd01bfb34174a1a9e29b004ff012
MD5 9c874339b76dca59b8a5388f00211981
SHA1 149869bc97590f0ea8c8d492670ebe287902c0a1
SHA512 ee24567475578f459246c4149b499f55114e1426b5bd74604e262599bd19ae338e68b158a6cea6f88c74252b19596bb5afa30efccc3360ef3fc1d4ae04c5214e
TLSH
T1B8A0026707829003C35513B462C906C13774A81112270B85E5A600F8C86C35E4A02081
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e3eb598fd7fd95e714a9c6869ecef50402dd6e1c65d10f4dce42e33dcea0d902
MD5 5365c6b2b6c1af4543ea71f7bcea1c8e
SHA1 f0211401b6545d39612f3b25bc381b9b6f0257d8
SHA512 c8e7424b94124f131914fb0ab18ff2d5436545cd30dd17ab43436a110a48997871772a6eb095b895a7c194418e37121423135d0b328f8382968833bd0f088df5
TLSH
T1D3A002B955C27102D65412F530CDC69132104899325117B6D2B206EDCC6C2444A17192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5afa9d.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe5afa9d.TMP
Size 48B
SHA256 ffa0765b72ea156b4b98a7a6b3e3350838948ac507fe65693bd553f99cb6dd0e
MD5 29744dbbfaeef62015f150f1fdd9dc00
SHA1 9806e3d0a01e8242d65a41200aa8e6bff781b034
SHA512 8671d7077187507980293109870051f4fd2e1e4c5978974b7d682235bca87474ee830626c70ac8a03ff27e58232a3dea7a6ce8c3aaeae0c730ce770342d0108e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
Size 10KB
SHA256 f1e00e1d04250ce14cceeef7a2a6cde84c738336c3be4e13695690b2af9cd5d8
MD5 5dd37baa4b4a8a6a0673bb636aa3e787
SHA1 6606ad016a07d7795a8bb4282df4d13b73cdf4c7
SHA512 dd3d8a15d6c4599a082bfad0ec5b4d6ace209e32c77ed3ed3d5779a7057dff65d45067bae9456656ddb107577ec47508ffc426717eb57b7c2ffbc60ff3358c30
SSDEEP 192:zRYZQH7sfv7rK4+9eHcb+WNV5XX6dGxRe5A8epv/yIsn2Kgu:zR0QH4a8gE28uNu
TLSH
T14D22B62FA930A57B6CC6D62AFA217756F3F5002176947D48D7FC8A2C24E76CC621381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5b219e.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe5b219e.TMP
Size 9KB
SHA256 e616da89b4aead04e5c54854b9536410c8331a03c8766bd0a516d6696dd784a5
MD5 b8e9529d3efb892d4e2c1d11f31a16f2
SHA1 c0f1858e1c3ff5ca6dd62cb137ca9890a6a1f42d
SHA512 8c5fbef2581a81ee74a4da89c56c1bc1f95b409fa5a918336d303824145eb16dd5fec8e1086117fa18dadb496889940ea598e8a8647b2fcad36508c64b2a0377
SSDEEP 192:zRYZQHBfv7rJ4+Xcb+WNV5XX6dGxRe5Ve/0yIsn2KgR:zR0QHBtXgEDrR
TLSH
T13D12A51FA924A57B6CC6D62AF9207796F3F5002176903D58E7F88A2C24D76CC622380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
Size 8KB
SHA256 95f51ac1dbd5dfeefd6e75b5aa1ebd5db6eb0a5431fe679828ec0b9fbc79e3e1
MD5 983acc30b6c37f66b480cf9087b54272
SHA1 0988c5c7a976cb7c3f4899a79373bdcdf273c580
SHA512 495fc3b74ee69619818082204728d1d708a5b2fa6653c97c8f27489a5fe126f9bf56f25221d9ff8b98bd833d7148bf4a0401991016efb2564c788c36931a9505
SSDEEP 192:zRQH5yWv7rOIt9RHcb+WNOoV3y/yIsn2Kgj:zRQHgi/XgDBMj
TLSH
T19002A42EAD20957FACC2E659F9257B82F3F5102175943D48D7F8CA2C28E7ACC522741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5b219e.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe5b219e.TMP
Size 7KB
SHA256 ed11eae7f08d3bf972b68637baea498fefb5356774c390a57c3bb00a0b6ac5ae
MD5 f639f468da58815932de7fd39573b5bd
SHA1 9a1f9a37e30f8c9e0dcfafc6a41f4cb5f9e8b4fd
SHA512 b124995de152ad691b32f044f978db50bdcfda180a6ed33f132cf8f7cf32daed29c3acb2206fa6c0eb8a68adab6ceea7912bae5f1381b3bb3331b99c60521627
SSDEEP 96:zRuvecoc7pmOxwtv7rENdKWCZwAeuX796b+WVoMPktNm+Tem9jD286WNLCyIsnIy:zRQH7Wv7r2ItXcb+WNOEC0yIsn2Kg8
TLSH
T179F1961EAD24A67F6CC2E62AF9217782E3F5102175943D48E7F8892C28D76CC5237417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Spotify\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 3KB
SHA256 58950bd39ddee7d854c554002e1579524297d19417e1822a4216b3ad319d14b8
MD5 c83dbe8e600664ad916b8000c477c0e4
SHA1 6a8e9a8aa27f25007e00552f6c30252040b6161a
SHA512 1742887dcd51e96a313189d907808c0946b5388b272f6d1ab80876ba8e3fa73e5f333cc341d0644553a4c11709f78c9ba84c6d86327fc837371dbb691b2ff844
TLSH
T19F61852664658D77A9B7E49578423B47FBB81027A2603FE8E6FD0B0C11FB5E81343917
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 6KB
SHA256 c9825ee67241568958bb355b9f2848a5109761356a5349e443ce0436d960b59c
MD5 895bbd36ed43ed353798d88645a2afd4
SHA1 1f7cc34e7defe3adbf925f7a927e32e2bf0fdc7f
SHA512 456cd764a054486c3e74caeabeae515388ade609ea343449107f1f952cb1b1a9cffa85624d322f081197ac6fcd200cfe87a4ec3410d030b55ea17831d3667448
SSDEEP 96:1HbJ6HfR5MG+d+Dotoh+DotoyN5BnD/B6HGyv6tNkLCkv8GNRWIUBm/8olP7CTDp:ltk5MGRDUxDUBFJ7US3tfZ9
TLSH
T18FD1943EE5CACE7BECEF85E1220277EAFB54011656905AD49DE65D0C01DF5EE220281E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5afb88.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe5afb88.TMP
Size 1007B
SHA256 1a0a8de1f12a117962f00b695c73c700715e5fe6659744ae5dbf48c202289649
MD5 50125d6d54d5d56e153986bcd8afa708
SHA1 04c157b61cb2959100a2665d79b231b0c4c09084
SHA512 26916e7d5df52eb7149d89b70f6582614d83b699df01b621fa3a015e72650da86f640900910b87ac855422d2b7fc300d5edc3c4b322a784f64227562a9b1bf5f
TLSH
T1C71154725C505A65FEA2B9FD31917B4F2E26043681B1078CBBEE132613BA5A81217C31
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Size 56B
SHA256 209496910ac7984d82f2d43a5d96c227b4a490c820032d595343c64d4dca84a0
MD5 c53a56ec8ad806591bd657adc73cdf08
SHA1 cb6e7529f148a769267f4d9f86991d298a9ee8e0
SHA512 2363a6eebd47a5ea58a148626f19195d703b17eadb837f0dce6789f7fe1fdc14c50a0e98b20b89c82a91925ce1333e2dcf77b09b6f8e7e22eef71f8640e32582
MD5 SHA1 SHA512

Submit Download

a4b0b15f-2e42-4856-84e0-8c2ac9954d48.tmp

Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\a4b0b15f-2e42-4856-84e0-8c2ac9954d48.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
Size 3.9MB
SHA256 8bacdfd42f45f62451bed32a0bd9275e4e1aaf732d742acfaf3f8879b93a9a32
MD5 d322f6d9b607c6439807ff94f0233686
SHA1 98c031f7a404a38972cde17bf49b9eeb43f9ca39
SHA512 d43aae288aa2ac8d1adafd67d33c2b7373af45f6069b8d620deee4da861b5d6d0da4e849bb62976ebe8160d2fbdd6d856d165cd5e39c70ee3747763a3a023685
SSDEEP 98304:kTBUyjse9mf8YJNURr4miCQ6AuHdVMSQzEbLNtxqMUQkZ:kddF9mfPg4aHdVAzEbr4MO
TLSH
T1F316333882F519C5C92E0E30C5AD0B69E2A21CD30912EFB6BD5591F70E4A1C7EFF9529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll
Size 4.5MB
SHA256 25ac2951a586975948e636965fd3ff1900a1177ef47b67460dd80519a441a542
MD5 316d00a8ff72656707c85d6881925f2e
SHA1 b286845913d5dfd13357e4b544c0325bfdf8d02a
SHA512 ae51f619e871236fb8fa4c89fb1d795157b0fb35c26af9acca54c21c569caa328e6b685e6391e70d57a5c0c98af9d824b43e410d4a68b44f7c651d8d319ce06b
SSDEEP 49152:USHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:PuktcrfNlTyj5byqSm
TLSH
T1DC268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.2MB
SHA256 0c827576c4394fa2cc7419867d147546a7ea82e52c577ddb9063a95806ea9b11
MD5 16291380ae636821b818ea4c201450c1
SHA1 9146fbbb2b2872ca712adf5f547d8503c5e0d29b
SHA512 afc765d9d70b08d87b1d90e73229fea674bfb7f0abf5005e2a82f06b17b9767887eb25a180ce6b1190e815cf78ead5e646fc2fda2f195d4facc48bfb3c7119a9
SSDEEP 393216:N76zmdtcytrFkaO5uORUdiPRt6RpdhzoG9W9o:PrBNhzjke
TLSH
T155979EAB71E401ADC0AEE1B9CB17DD17E7B7744A0732E34F02A082A21F67A60567F751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 89c308809a2a73cb63cea07d3dbe89a4e2aecf3440de29e6351e1355adcd85f3
MD5 6a9751a4b35d041341c53a15038bcfc8
SHA1 a54ab8d2bbdf846c9292f357676a90e6e085c8f1
SHA512 6d6bee861ec3cc1c59b988457c1ae45d29da1391dd6eb3fce53e219c673e6d90de4b24ff251c1096e42c93a3ca2fcaed6fa60faaf6f3cd8459143e07d68b4f1d
SSDEEP 49152:6HYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+di8:6HYg8xwfGrUA9Ncnas8jdJ
TLSH
T156D57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Size 705KB
SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
MD5 0321d6c44a6041910208ce3891727842
SHA1 42e8935bd94f0fa3fd8611fc84e25a06e8ba82ed
SHA512 6c9348ed4d50fb2503012b80c0dc8f4cf07d00d2ff857fff8c102266533e65befc6535998f9497fe414cd427dfaf0ff3e5cd1b586addba236b3794768e3d476c
SSDEEP 12288:bI3H1fJwhjzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnSzm5dVYJblIt6kjKQCrC:U3VBE7zEEmPL8bTe+gnSzm5d2bc6kGQt
TLSH
T1FCE412E77374AC7DEE9B1277826505B0FC371A681B82020A179BF8796913B48D8C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Size 1.2MB
SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
MD5 d995543b367f8675ba74b90f42790175
SHA1 ae7f07096d74d1565929fffbf1a9711a08fc74e1
SHA512 99018c2cd0685bcfc6de8d08a649515b606982f56f1dced3b5304c7358e74bb463aa89795752580abff98b288865b49720940f8f0707a5f2527457edda968685
SSDEEP 24576:i3zB09p2zLmmibkFR8+mZi5r8BWhQumeMRvQt93dyQwuSXAkpbaUGQ74:i3y23mNbkFRJmQ58khQRT1QPtauSXAkA
TLSH
T19E4522D7A370DC7DDD530BB7929B40F4FD7A106B0AB2140A0627BD7A39257889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 10cb24ce6ee9aaa217edc260dc73b640e2b77979de0e81596f471882e50eae24
MD5 4cae7b28dce3ce72dacb3953877038fa
SHA1 32a76c6073b0b163ef4a52b9e96e8e5ac46fa2b4
SHA512 6691cfae044a6ea0fd12b42ef3053b37ff12e12d5f234d8d64baf47cf58d13bf7264474072cf9d43219a87ec13f568290f15785007ed093fb46c63e5e6a66a64
SSDEEP 49152:hLOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l1i:hqG2qe6JBKDtXmKji
TLSH
T1F5C56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 632B
SHA256 aac028b09673d950449a7cc421340caecd1ef07b88e298eeef3e01b742050628
MD5 28d2dafc9d62283cdeb8cd72236285ac
SHA1 504184306fed528cde3dd324c3882a661fea0589
SHA512 50ca4543b0b221e0fea3c5ae56156186603776241c5feeee9a7b4a99364887ce27dc989e56121199fe0ae32f93e5b905302f6dff370bd7f24485f124d1719ee3
TLSH
T1F3F02DFF59D065B9A0F10BA1E03C63107CB205951B2B805846531F993B48F69CE5DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll
Size 504KB
SHA256 36644508c8dd408bf7eef9bdbeea3ecc5f4b96eace43ba42161b2c9fe770c8e4
MD5 bee922c7cef11d71a3a400daa06096f8
SHA1 bbc0308d86a5659d0b7afdd8592d89463f0ec44b
SHA512 3a31e3b32c351d8075e48f778f795afcf74291c3f62f5251aa791a5c0832dbc2405b828d78f5a254a435b5d88cc91dbbf4844d70efaf698ef69d1cfa93c4c5dc
SSDEEP 6144:UF1o4DAf5s1KStUkNbhk7Ak7KhPCcgoF0NKzdgbsQr7rVGCXoxk:o1o405CtUkBZk7K9CcgG0NWd/QDVGtk
TLSH
T11BB48E15B3E94AACE07AC134CA438547EB7178460B61F6DF02E0A2792F77BE45B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll
Size 7.5MB
SHA256 9bea677e29c8a05c16ed0777d3aac5ea20091bbf8f3c98755dbf1ab00e9ec876
MD5 b6af5f0bd69286e098f2c3de73e4c793
SHA1 8fddd83b0e327273f58734c470b14fa38aabf13f
SHA512 1463576e18e7ce62594d1c6a7e82e1ec469ecef2aa37be8518c92d966a306f10245c481d1f27374c024d3db892e520669bf092b9c3551b7fbea27117d41a29a9
SSDEEP 49152:3tvLjzlN4kFextqcusm4nHcpOjwrMQOT6n1SSCOQESgswJYgZc+5GTSpWy4EWT51:9WusNpjgKle2S+E8Nkpp0ve9fPzFC
TLSH
T12A867C13F69240DDC01DE2B8975B9223F778B8450764B2CF2A5453162FBAFE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Size 577KB
SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
MD5 2a1964ff31c7edff17f4c74d26fce378
SHA1 2c66f52ac23828ec6a18a6720ebfcb275482edcb
SHA512 fbb19f906ab8f61461c8be80d53a7cadddfe81524918171c0bfab45f9cec2f5c045ff7ff864858f5c087d4b05c585ba58dfdb7565302605efc524f388c241ba0
SSDEEP 6144:WpcHQYHQbmpKwey1WMmHfYOMg/jSxMP9sQqblfaYQhp1BPOjnng98//gwb:wwQKAGMDHfdgM6Qqbgaj+wb
TLSH
T117C42B1FF744122A05A352A27F099562FF32D06CA35112663CBD812C3376B6693BB7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Size 16KB
SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
MD5 8ce43bf0bee69290545738ae472bd5dd
SHA1 bbc36343250fa8bb2122c8af9e021fc80c032a0b
SHA512 67825fdb6c0381b7e35c73221caf37374157c1333388d0d20685f4d732340f7fc04faba29ae266fcaa921fff2694b5f8ca0ba24fbbdce2146189924e354df7a5
SSDEEP 384:5rg5RkIUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/neqA9oz+EFRUeLq4+lLbK74Tdu/:kgOXqEXqP
TLSH
T1DC72B89F1B21CA38E637477F6A5E3125EB3B805C4F91953419BBA44823C639603F71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-Hant.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
Size 16KB
SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
MD5 d41d181d619aef4a1af14bcd6ad2fc1c
SHA1 05ea268a59c887a92387a2ad2925285901bba1ba
SHA512 b2ed7c0c97672411266ef55cfed4e98a7d812e85a20706140c8ea8c566677ed9bdcfaac7d0656496e34db5a7a50e0c9e810fe9a18c2039630745ce617513b605
SSDEEP 384:pFTaUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/na5k+0SyIqLvsZXPuD:LxOXq+LBDXPuD
TLSH
T15E72175B1932CE38D5378B7E5B9F3624E63B612C5ED164342BEFB41423C636A16E2053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs

Path C:\Users\Admin\AppData\Roaming\Spotify\prefs
Size 154B
SHA256 384bfb33239a474245680935584097175e6c74d38d8ed2f2d2bccebe5caf70c1
MD5 f18f7b2ce934cee9ccb4efcd6b16ba29
SHA1 6dfa2836c85a121304cc9862a6ee8cf797921761
SHA512 b15edcdc5f8a76ed776a048dfe5742d131883e69f6fe3fcfb5e2f61f58030c7e88762fdeb356d72a10a46f0b863f9477f12e6946d0ef4c65d3bf71ca83ed12a1
TLSH
T1A1C08C89A003FB308C90054DA615B680C030308DB4CE1304492351081C8E71C2712252
MD5 SHA1 SHA512 TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Size 17.8MB
SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
MD5 c6c9a3d440e436b8c28867f3c3955ce9
SHA1 208847cb98181e6ba434dd5ec17d686824604946
SHA512 2e1d53d773f57cf8c311674d60615602670d44af7a7545c60172ebbd47d6bb32e382c4cc91a5394fc1a51dab4b654be822f81f1ea963ec1176624b0bea6a6f1a
SSDEEP 393216:pqX9UazcYdpnzyXm++SSSCZMwh56qAgbITfTK3l76TmkrqjFWBm0iw+X:pqtJzcYnzoN+wCW4AAITG3lVkMgmeI
TLSH
T10A17124BA758562BCE3F07B74652563F373091197F835307209283281C6A7FBAD8DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Size 16.6MB
SHA256 92b2d6a0950ba7d39333229b2c1ea8825042acc8c9bad12bb1bcf01db24bad56
MD5 fd631dc137d6e668da674350e76b1442
SHA1 e7c210b6fe36f264d42cd94438e4ff9defae178d
SHA512 6db0044980b403b365072d8417f20267b4fc5eb640883777461496050e0ddb69d4890e9965d149b72335f19840d0804ffedfeaee2ec50b3c13d6dc8adff3c6a2
SSDEEP 49152:PMK4h4UrzskpzKDURNdmbViebnI/StH0qCXxt/3wB+p0Hbuvu:ep0Hy2
TLSH
T18C074680E7F95348F2F77F65EEBA90564836BE96ED29C75E0405050E0831A4C99BAF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Size 5.2MB
SHA256 950cc641d85ee7239a7c95fa8e5f4118491ed996abd34de10b8c5f21db3dbdd9
MD5 d29b2ec8ab4c97e1d807c33d9aabfc7b
SHA1 d8fdedba0b7cd7fa9b3b66d15356292c71579c59
SHA512 e0db14c9870c488d4e072a3a2ae47fafcc14291c8344946009ce0708e0553b53d063e20a20cf224674e02f602ab50f7d1825c15096b43a5d5bdcc0030a49f465
SSDEEP 98304:v4ydZOjlb3GaE1COMOIFGOOOOOOOOOOOOqLOOOOOOOOOO6:YlC09GOOOOOOOOOOOOqLOOOOOOOOOO6
TLSH
T107463803F19680E9C06DD579875EA623B632F8840B3276DF66A01F1A2E79FE0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3220-402-0x00007FFE4CA70000-0x00007FFE4CA71000-memory.dmp

Download

memory/3220-401-0x00007FFE4D3E0000-0x00007FFE4D3E1000-memory.dmp

Download

memory/5968-660-0x00007FFE27690000-0x00007FFE29EF0000-memory.dmp

Download

memory/5968-647-0x00007FFE27690000-0x00007FFE29EF0000-memory.dmp

Download

memory/5968-338-0x00007FFE27690000-0x00007FFE29EF0000-memory.dmp

Download

memory/5968-337-0x00007FFE27690000-0x00007FFE29EF0000-memory.dmp

Download