37c2b1036b0e85d3654e657b57f581bf960b35597ce33a4a587cb727c630e5d2

Analysis

user interaction
yes
max time kernel
629s
max time network
437s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install_New_theme.bat
Size 615B
Sample260801-wam22aej21
SHA256 37c2b1036b0e85d3654e657b57f581bf960b35597ce33a4a587cb727c630e5d2
MD5 164693650a6c261b9c18b7348d72ba5d
SHA1 8abb7f8459ffcd1a2d916e53569d6b041f17c2fe
SHA512 61b716515ada6edb2b5e96566ca2a5a31098816c257c8c8fb5410b1ded375e5560567b9b9b2c5b10b05cdf93ae886b662aa07dbfdccf7b9e1893cd41a5a5c60e
TLSH
T176F008B3E18F1BAD1C4B45F5611A5A5801CF6582D755D09E23F78A446DC53DC4694380
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware discovery execution persistence privilege_escalation spyware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	1028	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	2236	curl.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Spotify.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 12 IoCs

pid	Process
3140	SpotifySetup.exe
2408	Spotify.exe
2480	Spotify.exe
5044	Spotify.exe
3984	Spotify.exe
4736	Spotify.exe
2932	Spotify.exe
2324	Spotify.exe
5064	Spotify.exe
1516	Spotify.exe
2840	Spotify.exe
2212	Spotify.exe

Loads dropped DLL 34 IoCs

pid	Process
2408	Spotify.exe
2480	Spotify.exe
2408	Spotify.exe
5044	Spotify.exe
3984	Spotify.exe
5044	Spotify.exe
5044	Spotify.exe
5044	Spotify.exe
4736	Spotify.exe
4736	Spotify.exe
4736	Spotify.exe
4736	Spotify.exe
2932	Spotify.exe
2932	Spotify.exe
2932	Spotify.exe
2932	Spotify.exe
2932	Spotify.exe
2932	Spotify.exe
2324	Spotify.exe
2324	Spotify.exe
2324	Spotify.exe
2932	Spotify.exe
5064	Spotify.exe
5064	Spotify.exe
5064	Spotify.exe
1516	Spotify.exe
2840	Spotify.exe
1516	Spotify.exe
1516	Spotify.exe
1516	Spotify.exe
2212	Spotify.exe
2212	Spotify.exe
2212	Spotify.exe
2212	Spotify.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1028	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2612	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	Spotify.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Spotify.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Spotify.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\Spotify.desktop.launcher\CustomActivator = "{18A68F64-72DD-42CE-A75D-EDBDAC226F5D}"	SpotifySetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\Spotify.desktop.client	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\Spotify.desktop.client\DisplayName = "Spotify"	SpotifySetup.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\Spotify.desktop.launcher	SpotifySetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\Spotify.desktop.client\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\Spotify.desktop.client\CustomActivator = "{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}"	SpotifySetup.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\Spotify.desktop.launcher\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\AppUserModelId\Spotify.desktop.launcher\DisplayName = "Spotify Launcher"	SpotifySetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" -ToastActivated"	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeIncreaseQuotaPrivilege	1028	powershell.exe
Token: SeSecurityPrivilege	1028	powershell.exe
Token: SeTakeOwnershipPrivilege	1028	powershell.exe
Token: SeLoadDriverPrivilege	1028	powershell.exe
Token: SeSystemProfilePrivilege	1028	powershell.exe
Token: SeSystemtimePrivilege	1028	powershell.exe
Token: SeProfSingleProcessPrivilege	1028	powershell.exe
Token: SeIncBasePriorityPrivilege	1028	powershell.exe
Token: SeCreatePagefilePrivilege	1028	powershell.exe
Token: SeBackupPrivilege	1028	powershell.exe
Token: SeRestorePrivilege	1028	powershell.exe
Token: SeShutdownPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeSystemEnvironmentPrivilege	1028	powershell.exe
Token: SeRemoteShutdownPrivilege	1028	powershell.exe
Token: SeUndockPrivilege	1028	powershell.exe
Token: SeManageVolumePrivilege	1028	powershell.exe
Token: 33	1028	powershell.exe
Token: 34	1028	powershell.exe
Token: 35	1028	powershell.exe
Token: 36	1028	powershell.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe
Token: SeShutdownPrivilege	5044	Spotify.exe
Token: SeCreatePagefilePrivilege	5044	Spotify.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5044	Spotify.exe
5044	Spotify.exe
5044	Spotify.exe
5044	Spotify.exe
5044	Spotify.exe
5044	Spotify.exe
5044	Spotify.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5044	Spotify.exe
5044	Spotify.exe
5044	Spotify.exe
5044	Spotify.exe
5044	Spotify.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1028	2612	cmd.exe	87
PID 1028 wrote to memory of 3080	1028	powershell.exe	89
PID 1028 wrote to memory of 1636	1028	powershell.exe	90
PID 1028 wrote to memory of 2236	1028	powershell.exe	91
PID 1028 wrote to memory of 4728	1028	powershell.exe	93
PID 4492 wrote to memory of 3140	4492	explorer.exe	95
PID 3140 wrote to memory of 2408	3140	SpotifySetup.exe	97
PID 2408 wrote to memory of 2480	2408	Spotify.exe	98
PID 1028 wrote to memory of 2488	1028	powershell.exe	111
PID 2488 wrote to memory of 632	2488	csc.exe	112
PID 5044 wrote to memory of 3984	5044	Spotify.exe	114
PID 5044 wrote to memory of 4736	5044	Spotify.exe	115
PID 5044 wrote to memory of 2932	5044	Spotify.exe	116
PID 5044 wrote to memory of 2932	5044	Spotify.exe	116
PID 5044 wrote to memory of 2324	5044	Spotify.exe	117
PID 5044 wrote to memory of 2324	5044	Spotify.exe	117
PID 5044 wrote to memory of 5064	5044	Spotify.exe	124
PID 5044 wrote to memory of 5064	5044	Spotify.exe	124
PID 1516 wrote to memory of 2840	1516	Spotify.exe	126
PID 5044 wrote to memory of 2212	5044	Spotify.exe	127

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install_New_theme.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-new_theme -block_update_on'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/SpotX/refs/heads/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/SpotX/run.ps1' })} $p """" | iex
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -V
    3⤵
    PID:3080
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" --help all
    3⤵
    PID:1636
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -q -L -k --fail --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-08-01_18-43-27\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.95-x64.exe
    3⤵
    - Downloads MZ/PE file
    PID:2236
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-08-01_18-43-27\SpotifySetup.exe
    3⤵
    PID:4728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wlvwj33h\wlvwj33h.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2745.tmp" "c:\Users\Admin\AppData\Local\Temp\wlvwj33h\CSC2F14AAD1D12643DC9957AC405C3EFEED.TMP"
      4⤵
      PID:632

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-08-01_18-43-27\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-08-01_18-43-27\SpotifySetup.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe /INSTALLCOMPLETE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.95.452 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffe620a5448,0x7ffe620a5454,0x7ffe620a5460
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2480

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.95.452 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffe6e645448,0x7ffe6e645454,0x7ffe6e645460
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3984
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.95.452" --metrics-shmem-handle=2052,i,1869474133406330547,1525107593885295545,524288 --field-trial-handle=2132,i,8771493564055005937,8211372185032605362,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2136,i,14138136355106980248,2621021159388743584,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2188 --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Time Discovery
  PID:4736
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.95.452" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1796,i,14540939698899895460,7794198184547638754,262144 --field-trial-handle=2132,i,8771493564055005937,8211372185032605362,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2136,i,14138136355106980248,2621021159388743584,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2156 --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2932
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.95.452" --metrics-shmem-handle=2540,i,4567463117834021229,11898522883855160521,524288 --field-trial-handle=2132,i,8771493564055005937,8211372185032605362,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2136,i,14138136355106980248,2621021159388743584,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=2596 --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2324
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.95.452" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1785605683399562 --launch-time-ticks=600386818 --metrics-shmem-handle=5780,i,10190670962874374246,917430745867307471,2097152 --field-trial-handle=2132,i,8771493564055005937,8211372185032605362,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2136,i,14138136355106980248,2621021159388743584,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=5812 --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5064
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.95.452" --metrics-shmem-handle=6732,i,11283415992123167529,1146478968265438593,524288 --field-trial-handle=2132,i,8771493564055005937,8211372185032605362,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2136,i,14138136355106980248,2621021159388743584,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=6784 --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2432

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.95.452 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffe6e645448,0x7ffe6e645454,0x7ffe6e645460
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 24ff09c12d340d60174db5d787b9ec699b54eb56e86fe5f0215f5e8aa52219fa
MD5 d8f4f7b1d3c6fa8a636843c3a727924d
SHA1 ecf481c2c82b2ad1a8d46d81e9b619d67e3f9434
SHA512 aec9fe49208cb1b168bbe406daaaaf4ee06a2772e424c1167c668d7cecc42a2771c4f941cba44ff42090f982cd61795ba61d3b741bf43d79d4978be646c2f943
TLSH
T14DA00264A9517107C6485BBD30815A8972A868A925150762D4A040DEE8547644512193
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a30d5.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe5a30d5.TMP
Size 48B
SHA256 efb52f0284092096b8c9d176fc13615495caac1a86d367723211f5aa1df83ad8
MD5 6ad72134f36d19f0578a9bfe8d68a4dc
SHA1 2949f35fbd14679a4302de0278487d11bd6fcf61
SHA512 75f9b0560b5342ecd5822562be526b76baa9d31ad4028f1fd2465faedf974f4bec4d397596a352bd258631f4a34101ef56c9843c54f861fdf3adcd6e00240d16
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
Size 2KB
SHA256 4cb762818d76469a4c64a4fc9222912e931ba92a58b71ba717359da9c42e4a1b
MD5 df67c1da4e51c383b9b3a091baa8dd20
SHA1 d02929a8169a5cfde80bd9ac0afbe19c09cb8e8c
SHA512 3987c2aa47a1b57a92112afd6a0d0cf3688479ec59d19446267dd9d70f14410d30745314f8088565ae2e8b0cb64124ae8537ada52674db7b720f077bd4e53a46
TLSH
T1774129E7C3DAC22DD95152F4E7187D1BCE2E0A2842283C2AC8E5BF5B67D1531E21465E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
Size 10KB
SHA256 f212d6adbd900c7e5e5644b7d86d8b3948820f84c059757425b1d62271656766
MD5 e2f7eb1c4b10beedf34b28655935b65d
SHA1 bc25e0f0109c9af7acd8865184f3f28382b1cb81
SHA512 04d169dc640f56a15acb1eb5daf5ac61a181de887d04b04351632efdd35b47494e3466d28a97dff7c8cb983cc94ad6b3d8cf84a82d6008cc96700dbc45f4cca0
SSDEEP 192:zR9ZVNtTv7e4k9zHcb+WNVJwPGdoxIX/UCJ/yIsn2Kgu:zRPvhIJgP/Uwu
TLSH
T12922D75BAA24757B5CC7E229F925BB52E3F5003934942D84E7FC993C15DB6CC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59f19a.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe59f19a.TMP
Size 10KB
SHA256 7af16f192bae2746a4abdde29858db15c60b7d81bf58953e0a821fc8fd024ae6
MD5 a4df25b88d0dbbb0152db9fe87c30a2f
SHA1 54c0cd9496c795dc4346bedd23619cf11df6fbd1
SHA512 9d5839bfd65d2719ab70158d4790506546e69b93765c4fa78f2cdd0f96ced3f0cb570441d50560fc04d53b1bbfa79a1e3bcea27541cfd783291d48d96a27a782
SSDEEP 192:zR9ZVNt8v7F4k9zHcb+WNVJwPGdoxIX/UeJ/yIsn2KgR:zRPvKfJgP/UUR
TLSH
T12E22B75BAA24753B5CC7E229F921BB52E3F5003934986D98E7FC993C15DB6CC2223427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
Size 922B
SHA256 fa8cf9de003ffe7807d871dae1a2133d31eb7239f684bd6df945f32f85740b7d
MD5 6e69a1141dbcf188f30382f54ee12d36
SHA1 853314d67e399894f34918121aee12cf22746d2a
SHA512 029cb358562227918e76fc42cf4f70352df11ed588f5d628cf4e893e69d9c4043ce432b252e18426c186f8c48cce672b809888b97f2b19831d0b689255ea21af
TLSH
T163115CF7C7D5816ECA4206F4A7157F1BCE1E0514532C386A89D4BF1B93E2871D11465F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
Size 8KB
SHA256 5ecc6f9c4986c86b972ecf6a23682e3d96136b2309c9378969194a6c090dc369
MD5 d6c3e76db026a7666f6eba250d3ba3f5
SHA1 258b203683c526d77e20927579552bb911319aeb
SHA512 cfe75c3208f0ce8925d40ad779021f62b246a8ef68511217a792beae4cd40032c938c1df00f7a6cd75bac60b942cd1c1802d42d5496a17fe92c8bb3d3e85e9d5
SSDEEP 192:zRskws4ZqYv78Im9RHcb+WNO4l/yIsn2Kg8:zRhVEC7gb8
TLSH
T18502B61EAD24657F9CC2E269FA253B42E3F5102135953D48E7FC992C28DBACC2237417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
Size 8KB
SHA256 645cc4a9fd804d031bac2b356608f37939eb57d4d766a63010700195b0d794bc
MD5 66e478007844ef4ccc86c11a1b990c0d
SHA1 193672723cc0888cf269971d01e4d68b9a6d246b
SHA512 90ac83ef36d9d5665b4863cc0b659720d993c6e47446b6156d6f0f532ae05204b900d8057e0a20a5ca035ffc46d16b000ec714024eb86a0e4e432041bc0cbfb6
SSDEEP 192:zRskws4ZqYv7gIm9RHcb+WNO7o/yIsn2Kgj:zRhVEm7gBj
TLSH
T1F002A62EAC24657F9CC6E269FA257B42E3F5102135953D48D7FCD92C28DBACC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59ca6a.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe59ca6a.TMP
Size 7KB
SHA256 6bedbb5430365158dedd170e4ccc338204f521b064c9dfb27c8cd067011e9293
MD5 4ff3f78e5b20e030247ccc6d6cab8cc0
SHA1 91fc13058ae13c3c668da7d5c606f7ca4c499159
SHA512 eb4aa2976c87c2d8031d4b5a53a577faae627bd49376c8b3b796745960c517df1be84818d9b59d1cba38b91972d190adc2cc30df9929f0a236dc1371560c7232
SSDEEP 96:zRAr4Z1odsJ/Vxwtv7adKWC8wAeuX796b+WVoMPktNm+Tem9j10864NLCyIsnIWx:zRAkwsJYv78ImXcb+WNO4M0yIsn2Kg8
TLSH
T1F0F1841EAD246A7F5CC2E265FA257B42E3F5102135953D48E7FC992C28DBACC1237417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 3KB
SHA256 f041b172dfd9659d90576d76cc749340962db965e1dc89862ab6772d17cbac60
MD5 9af79da83a7f3ccc97fdff5c594dec3c
SHA1 64848d3d8050f2bc1dec6e87ba6896a0e1809b2e
SHA512 a060e4ab2be92ed278b703ac659f8a4e696fbd889ac4c912c309b75fef88e54a73b831017c1a6110770240fbafaab75d217ab17c081fa7080c96bcde36c0e0b7
TLSH
T1EC61A526A4A89D7759B7D4D0B8423E03EBA9112BE2607ED8E6FD0B1C41FB6EC1343513
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 6KB
SHA256 31522ed840986a7d709c59cc845162e588ddec87cffe04d642be9e8c12acf941
MD5 ef67f558ffa1be57f7c7cc7dcb8ded7c
SHA1 48b53c5cecad22dc30a97c41f8dd142feb3f7de1
SHA512 cc09a975a3c1e7cf9afdb91392916994c588bf6cae07de32c253982ee39f51f70080cf7e62c4247ca89fffb26d3dc17e78530708ec29019921c2d5bcb8e8b027
SSDEEP 96:OlNbJ6yf7NvBVLp+Dotoh+DotoyN52NDuB6+nGyvYAMWlOIi29T3m37EIBgKBPHf:6NtPfsDUxDUBOOHGZPJPNADfgPh
TLSH
T1FFD1C6FBE586CA27ADFFA8C0260179D6FB54022582905DD49CE54F0C60DF6EE360680F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 6KB
SHA256 8c7558a96bb09069b1d4de4ea3371e3728463046f77dd30d3d738678bd30ecff
MD5 69fb83e01d66bb47efc6a220126041c1
SHA1 f0f2111be79b8c8b9516ec008c6b6b4e76e51a32
SHA512 93ea36966a685f6b66be6bc4b678cd839ebc68a939a2b86d85e9a7cd8cd5717def9033836ac10d0fd12624cb9c31905da88b710d9ba4fa54baf5124c910154bf
SSDEEP 96:OlNbJ6yf7NvBVLp+Dotoh+DotosN52NDuB6+nGyvYAMWlOIi29T3m37EIBgKBPHf:6NtPfsDUxDUJOOHGZPJPNADfgPh
TLSH
T135D1C7FBE586CA27ADFFA8C0260179D6FB54022582905DD49CE50F0C60DF6EE360680F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597c4a.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe597c4a.TMP
Size 1008B
SHA256 94e2320f8cc1ecc4caaa050a4f7847ba75785dfd67b7aa5f45d821a56a87a4f3
MD5 9cda8ff91cb24205481315a1fc8367d8
SHA1 3c4dcdf252b79ac8d89111074859808529e91295
SHA512 22148affe9f8e1672f82d05a43dcdb0f97dd16074fa9d186901421c3b0c0688ea2aff12016b58e63553cb7a40634001ec21e0eae8730c4352e0e0b911bcdcb55
TLSH
T1D81194B3EC802BA27DF290F470D26B031F164136C2A105C8B3EE0311D2B62EC1A03C72
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Size 56B
SHA256 9f025d92a8fafa485ecec411d4b968a65adc03f79100c0987c91dafdb0d77e4c
MD5 40a99398bdb85cf68148efd9c13b6d13
SHA1 aa06a6efde6ac774b3c98ff9ac68aa5a0d9a5cb5
SHA512 73b27666d5b9376d8fb9cae5ef668d12a117770acad62fd80d6fa63d56025ace35c7d1054c059cacdac09b19306e8537e3b84c0315b04e2f1da1584913379a31
MD5 SHA1 SHA512

Submit Download

b417e80d-e865-4773-ac76-44797933aceb.tmp

Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\b417e80d-e865-4773-ac76-44797933aceb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

RES2745.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2745.tmp
Size 1KB
SHA256 194f029bab3a2fa9f5375162f84c346aa2eedf947a61a5a416af1ca2db360c46
MD5 a0740afd8fc0a9e73a47682c6f4c3002
SHA1 ab132a780b82caf44f0499cb93c44477deb237ea
SHA512 3c35246af690792e00c83ef09854521861af81caaf7a59cd212ed34c8d34cadbb4abbf82714c53590c1cea15b4c960bd24066c195cad319e0036047b69dc9340
TLSH
T148218C0593E84B1AF0735B3169FA132FA279FDA5EF62979B854041282C41604EEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2uz44al0.bex.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2uz44al0.bex.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wlvwj33h.dll

Path C:\Users\Admin\AppData\Local\Temp\wlvwj33h\wlvwj33h.dll
Size 5KB
SHA256 e530cf8a52a46463d2eb2dadb899fb7d50f6837a0f09b24d0cc5f61e554de309
MD5 6dc153078b7b108d488c1a1442b8da1f
SHA1 20d01b50cfab73b2e160323ff1288bb6423341d4
SHA512 c16a56b9582f375b185d4f1254578098b6660c8f5d4a5092ca807ba97cf24f5d95f2ccbc1ae9542a64e1d1e1f480c6f1dee2b6fbf41387e646af0280a3646bac
SSDEEP 96:ZpY3XHnArOtNAvw8Z2bYKHeSqYG5EjbyNjcWmK:ToXvrAdKHNDbwjn
TLSH
T18DC1D70B27D45663E97B5B7AA6F3030293B0F815E563D31B3444517CAD705B85922AF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
Size 3.9MB
SHA256 78b633bd148a4d90b369b2d796c00407b2e41eb21933681bdac2e1df7680e88b
MD5 c02b747d37695f1b5cf70f7a3d09c9d8
SHA1 7e0a733d4ccea0b32f7dbfa8b453844a712ef481
SHA512 769cf8e2f07c29f8f74a099cf12fe28012e4916f5fe49a44c97e8f10209c0f8c2ac565cc91668a599d419351dcfd4e4c9a461c4a0d45c7976849dc5a245424e6
SSDEEP 98304:/Fsse9DU1GmiiURPaDM3sxGSUEauW60gE6H6AEZC5l3s2zKd:/G9DsG+VM857W6XE6HqCnsz
TLSH
T15716337802B91946C31F1A74C7EC5B66F5A2AC830F82EFABFD6541B313821C6D53A935
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpui.spa

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
Size 10.8MB
SHA256 d31ed79f4c0971921c30c8e8f43869c6406dbab50d8a78470754d9a48572d6b2
MD5 f1205cd1001f5ee8930d11082daad650
SHA1 5425da39bc3b26b8473cfdaeaa8a895cff267016
SHA512 e267f191cc43cf441c55b371f6f172b5cd1fd0839652d3001da902c289a51898cf40ff9fe1bfb2689b3031a6c1bf5af3220ae6f27e0b0e82a37be0cbf0dbba72
SSDEEP 196608:PWO9DLnJRnhw6S7JBTxNV8GF/E8Rsy4x/UO3zhsipqjoL4Jm:tLnrhE7JdKGq8RCV3y2/0c
TLSH
T1DAB633BD8E588CE1CB0F44B0DB9ED3A2E085C6431B42EA4FF93051569B9E5C81639F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpui.spa

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
Size 8.8MB
SHA256 c8d0468718c73f4c14d36e758f0aadb503512cc73ff50ff564fc331128502e99
MD5 1d79fc980eae48bb5178f678edeef71e
SHA1 c7cdbf7237796909b9f905f12e60dc38ed7bfb8e
SHA512 d509f3f3593cf065f641c810890e1c4ecc46fa0fc8335fee4c6dc6ecd965194f439b89f2b150962513f40f2538c551f8ea247863cf8760e6386ee2baadef54c7
SSDEEP 196608:P4O9DLtHFn3wmU7JWCxNV8GF/E8Rsy4x/UO3zhsi1:jLtp3C7JPKGq8RCV3y0
TLSH
T1E39633BD4EFC8CC2CA4A50B5599AA2B3D5558BD03A02D70FF830EA5566AD2DC0134FE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpui.spa

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
Size 12.2MB
SHA256 1ec19e70e69257e4cce8fc99883729a53481d8218b88536cffcd66423da1a056
MD5 e11d467b2fe17d3630e8803dd58c3da4
SHA1 931484d1da871b3e71548612c307235aa5320852
SHA512 6aefe969e385e01f9fd36e739e2ecc365acff2380bc1f561d6289519c5a6552edb54ca533c357afb511ab498392f5b1643cbad07b46fd6d7319c21d92c19a862
SSDEEP 393216:vDxZ73CRKVcwFdEUbw8g3kv0jRjsPwFhGI6s73NL:vFpSRKVcjUbw8b0mIFOsL5
TLSH
T12ED6337C8C284DA1C54F5A70FF9DDB65E08AC5520F83F18FAB105792A2958CCA03AF5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.3MB
SHA256 c0876e4c9193e7b56f67e2c3041f73278fd8488e4865f4bb6e3e5fb961a6d431
MD5 ad7f111674b566e60f6731cb2c4eb6a6
SHA1 69c1a703eec9c4f5a6ab373e1776058c7650aea9
SHA512 33185834765c2c2ba9f8e2c78ba8be9677d6b8e3ebc4cd26d4a7411bce9ceb89feff9038331e0578855f7bdabc33edfda5ec392a37fdf1d3e049c8768a30819a
SSDEEP 393216:XRO1oJ6wlZZaoLUQA7n6dvVNCAyryPOr8SO2bOi:XI1Oo6hYR5
TLSH
T1E7979EAB71E001ECC0AAE1B9CB179C17D7B7788A0732E34F02A492635F67A60567F751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 960KB
SHA256 c503181a033b14ce7ceee3148592aca54e9019c67533eb1d486180bb260d89ac
MD5 c04173d6b00f1af69ad0905a48f58a6b
SHA1 7831b24055ce534bc46d6d8923b975b4967f052a
SHA512 db6e1de879f85f1927eec1d72c43eefccde56a4584ef6bc75eb40f1ca830a26752047075705864d492b63999129d99c6b8f912a9fbe9a765245457a51e4a3b3a
SSDEEP 24576:fBsJJ7AGY37fDnrm9rsc3PNFh6vzuJfREJecH8z/AYkT4oNS/05Zg:JS7AL37fDnrI1Fh6aJfREJecHg/AJT45
TLSH
T1CA254C5FA2D010F9D179F0A2CE9ECF27E2B534AA8377A61D029143A65F3763054AE731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.3MB
SHA256 ae02a4ae79be66aa8783927366f7ec26aa7c3e5c095ff66934a762e9a12ab2ec
MD5 7858e0460b83552fe1aa8cf391632cb7
SHA1 a68109b30a5113dfed8992275422446a96458c6b
SHA512 f5ce3cff6f8a2fbf8f00d016b5098db0bd067a051ed295d43c72518ad850f738bac2b02eb7b959b5a4f3bf3fc8b4223a491287ee1086daf0877e55d662d27225
SSDEEP 393216:RRO1oJ6wlZZaoLUQA7n6dvaNCAyrIPOr8SO2bOi:RI1Oo6EaR5
TLSH
T16E979EAB71E001ECC0AAE1B9CB179C17D7B7788A0732E34F02A492635F67A60567F751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.3MB
SHA256 1455565ac06d105176be099347f0daa1cb0cbf9769c52b902b6d50b2da8fa913
MD5 fc852664a0b7880256c8ae5fa46d1aa7
SHA1 2c11147bc44c0b2287527d82d5aebbc80294143a
SHA512 139612217ec10da3b72b1b573048b825d997d443ca8a65761e09acfb20adc2d8433ada4ee24b4bbd8d73d21c732acf3083c95974b147bfd3894813b813faa76a
SSDEEP 393216:RRO1oJ6wWZZaoLUQA7n6dvaNCAyrIPOr8SO2bOi:RI1ro6EaR5
TLSH
T1CC979EAB71E001ECC0AAE1B9CB179C17D7B7788A0732E34F02A492635F67A60567F751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 5d2dc046ffeb27dba28d318f8fa0198f7fd40e63109c744c64a4bc32dcb50a9c
MD5 73809a8dcaa11c6013b98f9c554bdc75
SHA1 c6e350adfa74b400015d8c04566affec0483b058
SHA512 f56ef1584171efd931d56d102e83152166b55cc5772e993df6ea5790cbad6d818e4d10ea67a9b37184cf8acbbb711cca49c9840c2b4dc91993b90c4fa652a43c
SSDEEP 49152:FHYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+div:FHYg8xwfGrUA9Ncnas8jdW
TLSH
T1ADD57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 175786ba069b0c4fe962bd3d118061985518847e95d2990c5a92c3bd52297d9a
MD5 a46cde1da34986428f1780cba3d478be
SHA1 fb1e38e5ddf3109b6381001a7aab36510053c27a
SHA512 76762c1c76278fc803efc50aab1787e89bbbe76c0e4fc256de4efff45ae2885beee3723e3bfb0e82e5d022dd1f77e3546b1ca1f0cb977418bbd11f53396d787b
SSDEEP 49152:cHYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+div:cHYg8xwfGrUA9Ncnas8jdW
TLSH
T146D57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Size 705KB
SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
MD5 0321d6c44a6041910208ce3891727842
SHA1 42e8935bd94f0fa3fd8611fc84e25a06e8ba82ed
SHA512 6c9348ed4d50fb2503012b80c0dc8f4cf07d00d2ff857fff8c102266533e65befc6535998f9497fe414cd427dfaf0ff3e5cd1b586addba236b3794768e3d476c
SSDEEP 12288:bI3H1fJwhjzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnSzm5dVYJblIt6kjKQCrC:U3VBE7zEEmPL8bTe+gnSzm5d2bc6kGQt
TLSH
T1FCE412E77374AC7DEE9B1277826505B0FC371A681B82020A179BF8796913B48D8C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Size 1.2MB
SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
MD5 d995543b367f8675ba74b90f42790175
SHA1 ae7f07096d74d1565929fffbf1a9711a08fc74e1
SHA512 99018c2cd0685bcfc6de8d08a649515b606982f56f1dced3b5304c7358e74bb463aa89795752580abff98b288865b49720940f8f0707a5f2527457edda968685
SSDEEP 24576:i3zB09p2zLmmibkFR8+mZi5r8BWhQumeMRvQt93dyQwuSXAkpbaUGQ74:i3y23mNbkFRJmQ58khQRT1QPtauSXAkA
TLSH
T19E4522D7A370DC7DDD530BB7929B40F4FD7A106B0AB2140A0627BD7A39257889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 dcf9459bd1b7254627939fb0ad6b20c5cf1e412518584363ebb4733c9326bf76
MD5 ada512df4453b2e76c13a94ff76930ef
SHA1 ed5d9e7830c2289fbb3ddbe2b44d351ad513c625
SHA512 419d74172e70ee72eba3058b7b88be39e54d1caab988431ab746ed4f07ef498ad2dd9f70a9d61866fcf8969e707b4cc800439df11a6ca6268213fe5ae2468ee5
SSDEEP 49152:iLOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l1k:iqG2qe6JBKDtXmKjk
TLSH
T190C56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 07842ed82520e94c6af707a73a426d3ec4675d8b005d0972289aaa576f22da5b
MD5 152ac6664c3ac60535ba179a9a9e5b8a
SHA1 d79f53fe97210c2b4080f9ef1c3a76f59ddd42fd
SHA512 fd046fc901f313d44e1ebab8225c0a3351264d4bb2738256c340916fca30b53fc35bde735c614715c84d509aecfd5aa1556d6dbcf2f65f44c4131778b8ed04bb
SSDEEP 49152:lLOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l1k:lqG2qe6JBKDtXmKjk
TLSH
T1A1C56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 632B
SHA256 72e8d4af117a25ada9e7dc4f11eecadd3a1c0f4dec62377fdce08ed8b9321c7e
MD5 28a167f87a9985a11059e3d648e65b45
SHA1 e94bb1b2ba00dd4151ce57bbea2fde6a62270f72
SHA512 255071b6bde12dbcae634f3b75404ed272f05aa6159899be58c11d5083727869466c5bd280e98907c52f50618b16c8fa43d6de9600a848a594dd8f852252e768
TLSH
T104F02DFF59D065BA90F10BA2D03C63107CB205951B2B805856531F993B48F69CE5DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
Size 4.5MB
SHA256 9655dbb33756daa48f55ae1e74f6f87e7c3aaeed861b46c5d30b232ee1a220f2
MD5 6e574f746bc382f8e854af85ce9e9f3b
SHA1 0e16c9af923bf9cbd09338d8899da5dbd8d4f3b0
SHA512 da61ee102e0193c33934b3c5ff285219daba7d61c554b0dea1b5fd869a6e94b63437ea73dc74a814e541dde2c420c8a5a4baa695065060d1ecf267eb2ae42061
SSDEEP 49152:LSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqn:2uktcrfNlTyj5byqS4
TLSH
T1DD268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
Size 504KB
SHA256 e9661f8e27d85a7016fa5927f9a7f1f5369cd5b191096c78ed3f05bb2bda1c81
MD5 0fe800bbbb02df9988043c5845b2464f
SHA1 0e661da0b64fb48eb01abbb494ccf9ec53a64a65
SHA512 d0a2ae57fbb141f1091395eac5d67a4d050ecc4eeae86650e56037a385581d00136270f4b6588758d1132810818a56464307a1a7ebe06a5c28fa56f7e17c17d4
SSDEEP 6144:8F1o4DAf5s1KStUkNbhk7Ak7KhPCcgoF0NKzdgbsQr7rVGCXoxT:w1o405CtUkBZk7K9CcgG0NWd/QDVGtT
TLSH
T101B48E15B3E94AACE07AC134CA438547EB7178460B61F6DF02E0A2792F77BE45B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
Size 7.5MB
SHA256 b94a4effa73986bc66ac8492a18e9c91fde514c9fdec7f434ebd5d688b21cd28
MD5 f9801fe3569bab2f441a201dbfb81fb0
SHA1 286f83e1b0c7336ef738169a6153a07156f156e0
SHA512 be0b31dc38dc64404be5a739400579ba8adf7973a1ec65b9e02fbf9b22709a1b3a3a3a4a7f083d781c361bf6bf118f7cf9f0091fc225aca0089e93e3607c874a
SSDEEP 49152:mtvLjzlN4kFextqcusm4nHcpOjwrMQOT6n1SSCOQESgswJYgZc+5GTSpWy4EWT5w:gWusNpjgKle2S+E8Nkpp0ve9fPzFj
TLSH
T199866C13F69240DDC01DE2B8975B9223F778B8450764B2CF2A5453162FBAFE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Size 577KB
SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
MD5 2a1964ff31c7edff17f4c74d26fce378
SHA1 2c66f52ac23828ec6a18a6720ebfcb275482edcb
SHA512 fbb19f906ab8f61461c8be80d53a7cadddfe81524918171c0bfab45f9cec2f5c045ff7ff864858f5c087d4b05c585ba58dfdb7565302605efc524f388c241ba0
SSDEEP 6144:WpcHQYHQbmpKwey1WMmHfYOMg/jSxMP9sQqblfaYQhp1BPOjnng98//gwb:wwQKAGMDHfdgM6Qqbgaj+wb
TLSH
T117C42B1FF744122A05A352A27F099562FF32D06CA35112663CBD812C3376B6693BB7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Size 16KB
SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
MD5 8ce43bf0bee69290545738ae472bd5dd
SHA1 bbc36343250fa8bb2122c8af9e021fc80c032a0b
SHA512 67825fdb6c0381b7e35c73221caf37374157c1333388d0d20685f4d732340f7fc04faba29ae266fcaa921fff2694b5f8ca0ba24fbbdce2146189924e354df7a5
SSDEEP 384:5rg5RkIUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/neqA9oz+EFRUeLq4+lLbK74Tdu/:kgOXqEXqP
TLSH
T1DC72B89F1B21CA38E637477F6A5E3125EB3B805C4F91953419BBA44823C639603F71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-Hant.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
Size 16KB
SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
MD5 d41d181d619aef4a1af14bcd6ad2fc1c
SHA1 05ea268a59c887a92387a2ad2925285901bba1ba
SHA512 b2ed7c0c97672411266ef55cfed4e98a7d812e85a20706140c8ea8c566677ed9bdcfaac7d0656496e34db5a7a50e0c9e810fe9a18c2039630745ce617513b605
SSDEEP 384:pFTaUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/na5k+0SyIqLvsZXPuD:LxOXq+LBDXPuD
TLSH
T15E72175B1932CE38D5378B7E5B9F3624E63B612C5ED164342BEFB41423C636A16E2053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Size 17.8MB
SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
MD5 c6c9a3d440e436b8c28867f3c3955ce9
SHA1 208847cb98181e6ba434dd5ec17d686824604946
SHA512 2e1d53d773f57cf8c311674d60615602670d44af7a7545c60172ebbd47d6bb32e382c4cc91a5394fc1a51dab4b654be822f81f1ea963ec1176624b0bea6a6f1a
SSDEEP 393216:pqX9UazcYdpnzyXm++SSSCZMwh56qAgbITfTK3l76TmkrqjFWBm0iw+X:pqtJzcYnzoN+wCW4AAITG3lVkMgmeI
TLSH
T10A17124BA758562BCE3F07B74652563F373091197F835307209283281C6A7FBAD8DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Size 16.7MB
SHA256 a85c25dffe3bd9162dd19822b1178cd91640aa410f96daa6cc406441327c1113
MD5 f86a5f85b7456b00ff6ac337701b74fc
SHA1 b2cc57d71f265ef59b7f4028e63571fbc0440ad5
SHA512 3e43d4c5298f94af34c31f3a45aa90a46540f634475ed6c00ed73b4b915e6c6312eac2ffd91ddb33674621304fd6d1239e6db6ec8f6dfe188b638ce1035067f7
SSDEEP 49152:nVK5h7iOcWs2pzKbUFe72nViIinvlrtHfqzXxC5P1BrUGePrdoPfTxP:XhePrdkrxP
TLSH
T18F074680E7F95348F2F77F65EEBA91564836BE96EC29C75E0405050E0831A4C99BAF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Size 5.2MB
SHA256 f963e77e2e0825a7f210af09c8f903a36214e60e7ef2f7821995b431ae6eda4a
MD5 431a0b86dcc7254ec9852f1697e708a1
SHA1 28a676d22a9b44a15f8184cbf21891d28350095c
SHA512 30a951fd4f94009148d6173aa55cdc51182ee91a0fd0dd425b81e1b295415df31ec68aefea9582b225052e4eea433146a6c38febbe029be0df683af75cb802d3
SSDEEP 98304:Z4ydZOjlb3GaE1COMOIFGOOOOOOOOOOOOqLOOOOOOOOOOu:elC09GOOOOOOOOOOOOqLOOOOOOOOOOu
TLSH
T1B7463803F19680E9C06DD579875EA623B632F8840B3676DF66A00F1A2E79FE0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC2F14AAD1D12643DC9957AC405C3EFEED.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wlvwj33h\CSC2F14AAD1D12643DC9957AC405C3EFEED.TMP
Size 652B
SHA256 b657d641e8d69335819c9c2c250d7c8efef96b78d33393912c1a06ae88719866
MD5 fc92d98610c260a9867657af55c8fa7a
SHA1 2ee81fa486976a9d12f8d5fbc7d03ceeebfec1ff
SHA512 9c1d29beaf03a7fbe16c7fc876c0c328f9e1ddec25195cb6d99c0c0ba318d2b40aea4440e0cbdbab614f2d26bc770011e65308adc5be217890064dc765c3c167
TLSH
T1CDF0820A63F8460EF4F34B70BEF6536791ADBC65DE3297ED5440431D2C646108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wlvwj33h.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wlvwj33h\wlvwj33h.0.cs
Size 8KB
SHA256 78e0ec5b518d24be43e349f9306c1410c602ffe34136e1c5c97369747d266633
MD5 0215dce390f89b8078f8fd351be5e75c
SHA1 d5601a7273c9de0e2107aa8ccdb0f4ffea0f150f
SHA512 51b7e2e8cf526c1eac869c3ac4d03821f06e31e9932fbb4f1c0b63b90a26f2bc1c485d3ad47c04661400d0b617ef0bad0a02fdc3fe53e2bef9794831c3cddbde
SSDEEP 192:icCqCAv803CAvd77oiSCyc5hBC+Bl4VyiSCJdKbyfFE5rmEyAyi8y8:iQvw+j4I2amG2
TLSH
T14B02008C5EA35A194B43313C5FCA1509F721F82702CDFE09BC1D5680AF59936A2B5BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlvwj33h.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wlvwj33h\wlvwj33h.cmdline
Size 369B
SHA256 74366b784a7a09948614896ea46168bafd230ce71f4d18e61297e38a2c225286
MD5 a34ae26abba2269b524a56440b83923d
SHA1 f7f241dd0203cd442364e527796017649078967f
SHA512 0f93d1d5c205b37cdef1eb86cd45d25ff43217543f54bdfaf9480ae3925776732642cd77adc8b70daf1841a7edcf4e344239061bbb7a143ed806405a12bdb61a
TLSH
T169E0C02F8647C67D05DE1547226FC4BCC272078769603FC45051440FD05790267F1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1028-10-0x0000026ADA920000-0x0000026ADA930000-memory.dmp

Download

memory/1028-20-0x0000026ADA920000-0x0000026ADA930000-memory.dmp

Download

memory/1028-13-0x0000026AF56A0000-0x0000026AF56C4000-memory.dmp

Download

memory/1028-1-0x0000026ADA920000-0x0000026ADA930000-memory.dmp

Download

memory/1028-357-0x0000026AF5670000-0x0000026AF567A000-memory.dmp

Download

memory/1028-358-0x0000026AF62F0000-0x0000026AF6302000-memory.dmp

Download

memory/1028-0-0x0000026ADA920000-0x0000026ADA930000-memory.dmp

Download

memory/1028-394-0x0000026A90020000-0x0000026A90028000-memory.dmp

Download

memory/1028-27-0x0000026ADA920000-0x0000026ADA930000-memory.dmp

Download

memory/1028-26-0x0000026ADA920000-0x0000026ADA930000-memory.dmp

Download

memory/1028-25-0x0000026ADA920000-0x0000026ADA930000-memory.dmp

Download

memory/1028-2-0x0000026ADAE20000-0x0000026ADAE42000-memory.dmp

Download

memory/1028-21-0x0000026ADA920000-0x0000026ADA930000-memory.dmp

Download

memory/1028-19-0x0000026AF5AB0000-0x0000026AF5AD6000-memory.dmp

Download

memory/1028-18-0x0000026AF56C0000-0x0000026AF56CA000-memory.dmp

Download

memory/1028-17-0x0000026AF56A0000-0x0000026AF56B6000-memory.dmp

Download

memory/1028-11-0x0000026ADA920000-0x0000026ADA930000-memory.dmp

Download

memory/1028-12-0x0000026AF56A0000-0x0000026AF56CA000-memory.dmp

Download

memory/1028-16-0x0000026ADA920000-0x0000026ADA930000-memory.dmp

Download

memory/1028-15-0x0000026AF6330000-0x0000026AF6858000-memory.dmp

Download

memory/1028-14-0x0000026AF5C30000-0x0000026AF5DF2000-memory.dmp

Download

memory/2324-463-0x00007FFE89D50000-0x00007FFE89D51000-memory.dmp

Download

memory/2324-462-0x00007FFE8A350000-0x00007FFE8A351000-memory.dmp

Download

memory/2408-356-0x00007FFE5C190000-0x00007FFE5EA0B000-memory.dmp

Download

memory/5044-770-0x00007FFE6BB60000-0x00007FFE6E3DB000-memory.dmp

Download

memory/5044-735-0x0000019FFD830000-0x0000019FFDF59000-memory.dmp

Download

memory/5044-448-0x00007FFE6BB60000-0x00007FFE6E3DB000-memory.dmp

Download

memory/5044-1101-0x0000019FFD830000-0x0000019FFDF59000-memory.dmp

Download

memory/5044-1102-0x00007FFE6BB60000-0x00007FFE6E3DB000-memory.dmp

Download