Analysis
- user interaction
yes - max time kernel
30s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
SpotifySetup.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
SpotifySetup.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
General
- Target SpotifySetup.exe
- Size 1.2MB
- Sample260816-e5e68szzfy
- SHA256 718ba1cb98b42de2c4609953531e6b255e31ca31fd3645cb98b2ca040763fea3
- MD5 884e2b49b20437f0f543b5ba79a61752
- SHA1 c1e5089dc7fb85485f821fe6ce5b0a3a5fb97bc5
- SHA512 3bf199b6907d1dd54d67b34bfaa633b59d6ead249aec16918bae36c8e2eefc61607aa8f41bebb5ab406d96ff6e01f2a84bacb92bca617e23c5d18d76cbd43747
- SSDEEP 12288:S1hE8IcIrFEP48eZx5PpQsM4F5nLYU8ygnAgoF540B7DTSFi14ju:S128nIr2P48i5PpQJ4FNLYc76u
- TLSH T1D9555C895B28D6AEE363D17D4021D139E6717C220FD1924A42F9A2FC1E7B334796BF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 10 4764 SpotifySetup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 2 IoCs
pid Process 4192 SpWebInst0.exe 3868 Spotify.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1616 Spotify.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.client SpWebInst0.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId SpWebInst0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.client\CustomActivator = "{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}" SpWebInst0.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.launcher SpWebInst0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.launcher\CustomActivator = "{18A68F64-72DD-42CE-A75D-EDBDAC226F5D}" SpWebInst0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.client\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png" SpWebInst0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.client\DisplayName = "Spotify" SpWebInst0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.launcher\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png" SpWebInst0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\AppUserModelId\Spotify.desktop.launcher\DisplayName = "Spotify Launcher" SpWebInst0.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4192 4764 SpotifySetup.exe 89 PID 4192 wrote to memory of 3868 4192 SpWebInst0.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exeSpWebInst0.exe /webinstall2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exeSpotify.exe /INSTALLCOMPLETE3⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exeC:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.96.518 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffbb0245448,0x7ffbb0245454,0x7ffbb02454604⤵PID:4808
-
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=2428,i,14255551781273653972,1474270462823457822,524288 --field-trial-handle=2508,i,11048300162092813163,14467544858637834121,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2512,i,6655346387450845378,4684038938029754290,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2628 --mojo-platform-channel-handle=2616 /prefetch:34⤵
- System Time Discovery
PID:1616
-
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2200,i,7637068518437718489,13025256056981130761,262144 --field-trial-handle=2508,i,11048300162092813163,14467544858637834121,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2512,i,6655346387450845378,4684038938029754290,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2516 --mojo-platform-channel-handle=2504 /prefetch:24⤵PID:4304
-
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=2916,i,9708503474371914942,6696264833076712590,524288 --field-trial-handle=2508,i,11048300162092813163,14467544858637834121,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2512,i,6655346387450845378,4684038938029754290,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=2980 --mojo-platform-channel-handle=2976 /prefetch:84⤵PID:4224
-
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1786854149045618 --launch-time-ticks=577064621 --metrics-shmem-handle=5868,i,1049212475835006555,1322300422275801748,2097152 --field-trial-handle=2508,i,11048300162092813163,14467544858637834121,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2512,i,6655346387450845378,4684038938029754290,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=5896 --mojo-platform-channel-handle=5892 /prefetch:14⤵PID:5060
-
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=7408,i,8784019899257514874,1746170751954971860,524288 --field-trial-handle=2508,i,11048300162092813163,14467544858637834121,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2512,i,6655346387450845378,4684038938029754290,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7416 --mojo-platform-channel-handle=7412 /prefetch:84⤵PID:4200
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:512
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized1⤵PID:4656
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exeC:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.96.518 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffbb0245448,0x7ffbb0245454,0x7ffbb02454602⤵PID:2576
-
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\180446a5d2a349e3bec58fe86187a272 /t 3892 /p 38601⤵PID:3356
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1764
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134313283689647147.txt
- Size 89KB
- SHA256 a8e1b3561743a48caf10fa155d368ac018e7531cc1ab856a0cb3215be4935310
- MD5 0d39ba1613e1192068fb3d760a748c8a
- SHA1 fcbbce03ad3e06fedff88ab83054018d2dc000e1
- SHA512 ffc03f663a4e815ab93727fcc4d179bda5a7d18dfb3702993c1fcad0070a1f18b51648272507886dcc4f8d6d7a7bd47410ecc47de5b47f732f98791a96f2e9b2
- SSDEEP 384:i/v8/n5b/Hp/ymL/aNU/gT2/Hl/M1/h8r/hJ/Zk/Ey/eX/MA/NV/CzS/1o/Yd/ec:vjGzozuyCoRR1V1D
- TLSH T16A93B3A53281CBF3317966A0BCD9E435E13926B1E0A88F4461FA9617FC5ADDC62313D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
- Size 10KB
- SHA256 d78d8e3e19e95a895a28d215100975abeadb37aea31b2070682928302e471148
- MD5 83e8f4e3789acd82e86a3f8d7c0818d6
- SHA1 d9a366c7af2503593b21aee668f32d53fefee928
- SHA512 c919f9d36d1b4e2a4fbd25b8d26dc2ada0e12fca20763e2c20e3cc1e828e12d53cdc2f1510867f1397558f55ed53bb2184df7edb22d96de3796c48643abf9495
- SSDEEP 192:zRqZZeDB5v7/499dHcb+WNVLSIOdW5topm/yIsn2Kgu:zRqDeVZcPgoCu
- TLSH T1B222A51FB824657B6DC6F229FA257B53E7F9102124906D88DBFC892C29E7ACC7123407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe59d94f.TMP
- Size 9KB
- SHA256 29a0e3e3855c45b8804d81fee346aa874d2cdf0cf1906124a0b49558d19e9831
- MD5 5bbc13379a9f5616ef53ebb68d048b81
- SHA1 c895f5d5d19db1f429eee5324eb190b4d45f565c
- SHA512 8b89e41b4eacf6dd1c9b9b5382eddc8739db3ff11038a9f80aa0eb40cdc51d914148548dd228800242b623cfce9fa815fc124c5a1667e629e507ce01c4a8c861
- SSDEEP 192:zRqZZeDB5v7x499dHcb+WNVLSIOdWS2/yIsn2KgR:zRqDeVZKPgNR
- TLSH T13922831FB924653B6DC6F229EA257B43E7F9102534902D88DBFC892C29E7ACC6123413
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
- Size 59B
- SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
- MD5 78bfcecb05ed1904edce3b60cb5c7e62
- SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
- SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
- TLSH T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
- Size 8KB
- SHA256 38adc1d78d5bce7d86de4dd5e9fbf0b2d5c54f094b4863c0238dc579237d7a39
- MD5 ea5c3876f1116817c50e9a8b21b6773f
- SHA1 ac0bf0dbdd0afe05dd1bd2082ac3cee756f549c5
- SHA512 da62c293e57bd1e394d86a1e4c1992ff469c5beb4753b55c3a3d5048467e68713e7b29c62a0b163c6ddf09c3d42cce7572fa3790191fbfea5a1c9b60eef323c3
- SSDEEP 192:zRNYU/v7DIv9zdHcb+WNOHWG/yIsn2Kgj:zRNYC2RNgjAj
- TLSH T19D02842EAD24657FACC2F259F9253B42E7F5202135942D48DBFCC92C28D7ACD6227417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe59d920.TMP
- Size 8KB
- SHA256 62761e52f71f6fcc68b656895ff80b70c303fd857882f978773e3b584df8a230
- MD5 5954e01a2bbf5850de929fff1878c51f
- SHA1 59288f31a02528568ae75208be7c369191cb8c90
- SHA512 6c60679f644d4e4aba429ef770515f1849bbc6535a5f55af041bf0df9cd3ce81925f7245f2fe16d9e15cb249e18fe591015c2c076c5e167b0da7190879327287
- SSDEEP 96:zRSxpovN0owUUYYxwtv7qXcdKWCTwAeu9zdH796b+WVoMPktNm+Tem9juU86oCLj:zRNYU/v7tIv9zdHcb+WNOJ0/yIsn2Kg8
- TLSH T1FE02841EAD24697F9CC2F259E9253B42E3F9102135943D88DBF8892C2CD7ADD6237417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Spotify\Local State
- Size 3KB
- SHA256 735254db9045387284b74130528763708379c94ccc6c2ebaffcb52013b6ffcd6
- MD5 ae2cf363169e34af31d40da38961e67c
- SHA1 ca3e3477e0b71d224fc28962296791fcc8b7441f
- SHA512 58a0d9c09a7aa0dd103616879eb2c0cb1fe908f1bac0579b96d9a3ca3654df831d18f965c3900e6ebc6126a1f22114b26a054531bf712ee1bd5ebf734b34eee5
- TLSH T12361B42664699D376AB7E040B9033B43EFA82117A2607FC8E9FD8B0C14EB6EC1343407
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Spotify\Local State
- Size 6KB
- SHA256 0cc81e4aeb7eac7e519b2f1befdc5843ab1e1b426815909dd6c005e69ab75244
- MD5 bb1a44961fb66940f01daf153510295e
- SHA1 7bc5d41fd96892b2838ba0d49e88097798077101
- SHA512 40df079f06733a712eeb58ea5cf143d07807d8e9632e8d8f44792d5f41ffe83a6d3584726e6030e52b8bf6ab961b1e2de1423d51bad319186061df84e63546d8
- SSDEEP 96:IybJ6ofSnDzMR+Dotoh+DotoyN5ADzDgB6R0GyvQkjnjhunlpt7wea:ptun/fDUxDUBArECJdkjcpte
- TLSH T1C2D1733AE5E6EF27BCFBA59526017786EF54122612905ED48CE98D0C04CF6FC220690B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe59b349.TMP
- Size 1008B
- SHA256 d099c246d53ac2aca44102139035c1827d9cb0a5db0427eb1038793579449170
- MD5 f367864573b4870e518358ab17463522
- SHA1 aaa26d87641341773f99de31eae6b542d619fdd0
- SHA512 54cae5cba5e69c45141ca113b2a97d0eacc3128f8386ad1ecd0f36138c482d60b75ac8ad7f793f2d76773d863021286a465b562d9bb480e250092ed1e52f31d0
- TLSH T1601194B3D4016F33FE425134730B67830F241225C112AA8CAAEE671511FBAAC4217C3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
- Size 56B
- SHA256 086b88dac750f59f9d6a70031b1ef3e45ba99c404090851a35be63bd0149bf24
- MD5 dce61b57fd8033d2892df63bf66f090c
- SHA1 383f2dfa70cc4b2e0ee9919b33ba4814871d5f3a
- SHA512 cd93eca91b4ec8fc0e05671b99e3cdd3d023bfff028ed87db5b4b75d3b85bf41c040cf257922a181a31078e7d38c42de27ae45bb53d5f6af313d79d63a4fdfa1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\ac78a578-98b5-42da-8736-e74a5f9c2426.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
- Size 16B
- SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
- MD5 206702161f94c5cd39fadd03f4014d98
- SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
- SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
- Size 3.9MB
- SHA256 ab20e5730ce3e31c1b8f0ba62fab40a20205d9faf2c8c748d0f02330c181609b
- MD5 e9c4d3f93c2a9b06f60d15b3ca67caa8
- SHA1 1c0d01e88a8955c9ba64248f1a493002e271e561
- SHA512 f0708bfe111c97548c72f10f397ad49635642ed6dd13b3a2ea48e6f78ab97c58b308cf2106f7f055250317f11c052ad00fd81cd3c010f066bcae29ea7990a0d9
- SSDEEP 98304:EySAEdHkArQ5Xa+oeyQmipURqgKqMsxSn+KqjGse9VGQgz5m:EWEdHA0+fP9oMsgn+K4e9V0z5m
- TLSH T12316333843F51E86C61E2A74C7ADDA6AE08D1E930903FF6FBD1593721A466E38370935
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
- Size 40.5MB
- SHA256 e3fb0cf4b033c7fd689e5a1486c3fec298c263f73868b6085ab4671b35ad538d
- MD5 e239355b47ab28e84fe852491f3e22f4
- SHA1 99fc9399206b81893b7895280ce5356763750127
- SHA512 47878f4f9c4052b625558cf766df34241098473f520e5a74af4befa3e25edffb416899111a185a0c4887b6fdfd2cb9722d26cc1984b072901647cf76ccb418d0
- SSDEEP 393216:7agVCJ/J3j8BRU/gx1yNPo+kY+9E0iY7zAA7D461/qudf:7xRRUtWnCCDh
- TLSH T11D978EAA71E401ECC0AAE1B9CB17DD17E7B7748A0B31E38F02A092621F77660567F751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
- Size 33.9MB
- SHA256 038cdc4bbc565e2ec771ab3fc9b85e41c2fb0e71530231dde222147a4c7dfa44
- MD5 6e657df5152074d45e1ad497aad19a9e
- SHA1 309db5dbedaf64d365a2d093510e70bd20dec86e
- SHA512 abf1142a6e21d306634dc431fdabeea5839a05374fb570269b249dbe861fa0f517215bcaa6777a748f0e19eb0d5949a0472f825c5b533a132e41c5e3e91cce63
- SSDEEP 393216:7agVCJ/J3j8BRU/gx1yNPo+kY+9E0iY7zAA7D46f:7xRRUtWnCCDB
- TLSH T131776CAB61E401ECC0BAD1BACB17DC17DBB7744A0731E25F02E096A35F67A60563E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
- Size 2.8MB
- SHA256 31a16d06a39339c3b9befef9089b17e4a45b946bccae668b569157ee244b2a7c
- MD5 b6cb4abfa393031dee6880137423205f
- SHA1 697f38786b08074b88a98e558b0d25318c13defc
- SHA512 4f2c60a69e962c0d612bef62c8fdf51022a8a382c8870cc10c2980ce8be3cb56d801ad94a47116d7c72a21631d1b157c880353c6c7aefe6ab026dd1afeccc4a3
- SSDEEP 49152:nHYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+diN:nHYg8xwfGrUA9Ncnas8jdE
- TLSH T15BD57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
- Size 705KB
- SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
- MD5 0321d6c44a6041910208ce3891727842
- SHA1 42e8935bd94f0fa3fd8611fc84e25a06e8ba82ed
- SHA512 6c9348ed4d50fb2503012b80c0dc8f4cf07d00d2ff857fff8c102266533e65befc6535998f9497fe414cd427dfaf0ff3e5cd1b586addba236b3794768e3d476c
- SSDEEP 12288:bI3H1fJwhjzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnSzm5dVYJblIt6kjKQCrC:U3VBE7zEEmPL8bTe+gnSzm5d2bc6kGQt
- TLSH T1FCE412E77374AC7DEE9B1277826505B0FC371A681B82020A179BF8796913B48D8C93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
- Size 1.2MB
- SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
- MD5 d995543b367f8675ba74b90f42790175
- SHA1 ae7f07096d74d1565929fffbf1a9711a08fc74e1
- SHA512 99018c2cd0685bcfc6de8d08a649515b606982f56f1dced3b5304c7358e74bb463aa89795752580abff98b288865b49720940f8f0707a5f2527457edda968685
- SSDEEP 24576:i3zB09p2zLmmibkFR8+mZi5r8BWhQumeMRvQt93dyQwuSXAkpbaUGQ74:i3y23mNbkFRJmQ58khQRT1QPtauSXAkA
- TLSH T19E4522D7A370DC7DDD530BB7929B40F4FD7A106B0AB2140A0627BD7A39257889AC6783
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
- Size 2.4MB
- SHA256 24eafefff6b2d53bc408ee41b0607229c111afa07dbdc04d71ad5a25b43027c2
- MD5 1da0531265cf40608f7513c0a92f5195
- SHA1 08a9b3fc5c5c9d5ffb68f148987e31a81cb5222b
- SHA512 35045fec73b7535d5018f28c3b023e0574f71779f31ce1bb70fbfc6dd761ee13699499f253e0c5587d97ee75c25db6cb440093f8b317595296be9c6cded1972d
- SSDEEP 49152:eLOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l15:eqG2qe6JBKDtXmKj5
- TLSH T105C56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
- Size 632B
- SHA256 33f70749cdc5ecd6bb047147a2e767d7a279c631f6524ebb1b1df60e6bf93d6e
- MD5 1a161b0b901cc6809fef313dffdb2aea
- SHA1 8471fc229692429ee2df88d49be2d7a6e12bf31c
- SHA512 1a8d594c61829d4b1f50f70d0ff2c743b05e6c7fd8747bf63b184f4567b14fe76611589d0695cfffe667f675e0b901fce9be04243e6281e96429168fe3b73d72
- TLSH T1DAF02DFF59D0657990F10BA1E03C63107CB205951B2B805846531F993B48F69CA5DAB7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
- Size 4.5MB
- SHA256 3b01ff1bc4a18b63a790c5f6de8e17573de4c5280570ad8677a7767fad304af2
- MD5 745dc55b1fc592bcfbfdf5e0c0336b45
- SHA1 1f0799498e8b24edc1001ec3cf48e0803c46a4c7
- SHA512 514af49e2efb8a75413a977234b14115d156e80cc282a8d381bcf4a4ffddf8ff02a24aee1733568e9dd7da1422c1b8daeb8cf9ba5a07d3ca2a57710e27b22385
- SSDEEP 49152:0SHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:vuktcrfNlTyj5byqS2
- TLSH T100268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
- Size 10.3MB
- SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
- MD5 5bfd3eefca4b5ef2d1a869396390a7de
- SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
- SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
- SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
- TLSH T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
- Size 504KB
- SHA256 f9ee6e166b95763900af0937ada47b11c5d1129f49f7dfeadaa18fb10d0b1efd
- MD5 581c292b0ff892d1f534110d44aa482c
- SHA1 12bde8c12391f77915fb0c7b6a035949be3e24e9
- SHA512 d4368c17d4b1348699f1e51fed00b118977a9d441d11d7ab755d6e1a2eafaaeccc7d30d822fb812cbe5f0b6f031997ef8fc76a186bd66ecf4b1c7587ee5cc9bf
- SSDEEP 6144:vF1o4DAf5s1KStUkNbhk7Ak7KhPCcgoF0NKzdgbsQr7rVGCXoxd:N1o405CtUkBZk7K9CcgG0NWd/QDVGtd
- TLSH T1C3B48E15B3E94AACE07AC134CA438547EB7178460B61F6DF02E0A2792F77BE45B7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
- Size 7.5MB
- SHA256 630a0e4217d83078b074a1d66e4a4723f9e4f310b24ba0e6a8c3092837b851d1
- MD5 5afda51421b049aa491a4fdd86f65ad5
- SHA1 be9af5237af486276ca32c94cf14f06b2f32f1a4
- SHA512 25d142068e766ba2855aef03f651651f9debdd97d9e33ea20d411ece89223ffd8532cb37a0c5f0dcbd1afa6e82d44484128e8953d6e810de3635a12a51556a6e
- SSDEEP 49152:ktvLjzlN4kFextqcusm4nHcpOjwrMQOT6n1SSCOQESgswJYgZc+5GTSpWy4EWT5S:SWusNpjgKle2S+E8Nkpp0ve9fPzFV
- TLSH T187866C13F69240DDC01DE2B8975B9223F778B8450764B2CF2A5453162FBAFE0AB7A714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
- Size 577KB
- SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
- MD5 2a1964ff31c7edff17f4c74d26fce378
- SHA1 2c66f52ac23828ec6a18a6720ebfcb275482edcb
- SHA512 fbb19f906ab8f61461c8be80d53a7cadddfe81524918171c0bfab45f9cec2f5c045ff7ff864858f5c087d4b05c585ba58dfdb7565302605efc524f388c241ba0
- SSDEEP 6144:WpcHQYHQbmpKwey1WMmHfYOMg/jSxMP9sQqblfaYQhp1BPOjnng98//gwb:wwQKAGMDHfdgM6Qqbgaj+wb
- TLSH T117C42B1FF744122A05A352A27F099562FF32D06CA35112663CBD812C3376B6693BB7F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
- Size 16KB
- SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
- MD5 8ce43bf0bee69290545738ae472bd5dd
- SHA1 bbc36343250fa8bb2122c8af9e021fc80c032a0b
- SHA512 67825fdb6c0381b7e35c73221caf37374157c1333388d0d20685f4d732340f7fc04faba29ae266fcaa921fff2694b5f8ca0ba24fbbdce2146189924e354df7a5
- SSDEEP 384:5rg5RkIUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/neqA9oz+EFRUeLq4+lLbK74Tdu/:kgOXqEXqP
- TLSH T1DC72B89F1B21CA38E637477F6A5E3125EB3B805C4F91953419BBA44823C639603F71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
- Size 16KB
- SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
- MD5 d41d181d619aef4a1af14bcd6ad2fc1c
- SHA1 05ea268a59c887a92387a2ad2925285901bba1ba
- SHA512 b2ed7c0c97672411266ef55cfed4e98a7d812e85a20706140c8ea8c566677ed9bdcfaac7d0656496e34db5a7a50e0c9e810fe9a18c2039630745ce617513b605
- SSDEEP 384:pFTaUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/na5k+0SyIqLvsZXPuD:LxOXq+LBDXPuD
- TLSH T15E72175B1932CE38D5378B7E5B9F3624E63B612C5ED164342BEFB41423C636A16E2053
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\prefs
- Size 154B
- SHA256 9907ff9ac2c57f7da8ab95f0487116377f50757cd6150df584e453d0ab710db8
- MD5 06e57bb5316bb443cd04640c3362a0c5
- SHA1 a7383f71ac8260394a9bc48a709573d517d11b76
- SHA512 a17527fe949f809491537a8f3d3cec0ba543086d6812781501c9f689213e8d82473f8175b54438452d3ff85e8c65607e89ef07a407f2e21cf9f03e7e847a27d3
- TLSH T16EC08CA9B003FB305CA0055DA2197244C130348EB0CE1214492701080C8E71C6612263
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
- Size 17.8MB
- SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
- MD5 c6c9a3d440e436b8c28867f3c3955ce9
- SHA1 208847cb98181e6ba434dd5ec17d686824604946
- SHA512 2e1d53d773f57cf8c311674d60615602670d44af7a7545c60172ebbd47d6bb32e382c4cc91a5394fc1a51dab4b654be822f81f1ea963ec1176624b0bea6a6f1a
- SSDEEP 393216:pqX9UazcYdpnzyXm++SSSCZMwh56qAgbITfTK3l76TmkrqjFWBm0iw+X:pqtJzcYnzoN+wCW4AAITG3lVkMgmeI
- TLSH T10A17124BA758562BCE3F07B74652563F373091197F835307209283281C6A7FBAD8DE6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
- Size 16.8MB
- SHA256 148fb1b705a31315ee286cfc344c9e0279d0cd43d386ae4f381e7846a34e434b
- MD5 29afbb4ba906ab75ad5dfa327497e3ab
- SHA1 f2be1fbb5f4fd60fbd5417048714a5cc72dc3f3c
- SHA512 751089634c5070f24a2fcdb3e558f865bcb422c6e28f11df84e415e9faa7c9eb0bed67d5ac4c1f6eebbb2f0b7646314c9d3896714eb6ce25b8c8ced68eee107e
- SSDEEP 49152:I6K5h7itRHs2pzKbUVUGeYVigknbNmtR0q3XxMGPgBoycnpMi:nyqr
- TLSH T128074680E7F95348F2F77F65EEBA90564836BE96EC29C75E0505050E0831A4C99BAF33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
- Size 5.2MB
- SHA256 a92fba6360ddc71779d8ec480f21d4959f5f6c10db24741e19c6ddb0d6ffe85e
- MD5 17a065d79416e6e09f1b96b236017d42
- SHA1 def1009f11aaf1b2db0a76131546b2e4068761b2
- SHA512 cb9f485e4227311620262d1bd2151ea961054c5a1403aea40f06ff565c9aad561f7a55205e190ed46c799b5891484bd261d1d7b974aa4ea65893909f26a061d2
- SSDEEP 98304:84ydZOjlb3GaE1COMOIFGOOOOOOOOOOOOqLOOOOOOOOOOa:vlC09GOOOOOOOOOOOOqLOOOOOOOOOOa
- TLSH T1A3463803F19680E9C06DD579875EA623B632F8840B3676DF66A00F1A2E79FE0673D705
- MD5 SHA1 SHA512 SSDEEP TLSH