Analysis

  • max time kernel
    36s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 12:20

General

  • Target
    SpotifySetup.exe
  • Size 1.0MB
  • Sample260820-phtffszvhs
  • SHA256 54dda0a405e88b0ce11f786da6f47df3d2f5986c5b627ae6599dce6257625620
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Modifies registry class 9 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe
    "C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of WriteProcessMemory
    PID:3536
    • C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
      SpWebInst0.exe /webinstall
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5032
      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        Spotify.exe /INSTALLCOMPLETE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.96.518 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ffcd93f5448,0x7ffcd93f5454,0x7ffcd93f5460
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4976
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2200,i,3242012528759754085,5406357961815898742,262144 --field-trial-handle=2516,i,17468629787760928933,14481301124580882611,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2524,i,6783056266611350822,13967780379646763324,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2528 --mojo-platform-channel-handle=2512 /prefetch:2
          4⤵
            PID:4952
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=2712,i,7102856762223696215,1914970640225586089,524288 --field-trial-handle=2516,i,17468629787760928933,14481301124580882611,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2524,i,6783056266611350822,13967780379646763324,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2780 --mojo-platform-channel-handle=2776 /prefetch:11
            4⤵
            • System Time Discovery
            PID:5352
          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=2904,i,9515350345238743266,18266668183246493383,524288 --field-trial-handle=2516,i,17468629787760928933,14481301124580882611,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2524,i,6783056266611350822,13967780379646763324,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=3252 --mojo-platform-channel-handle=3244 /prefetch:13
            4⤵
              PID:3360
            • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
              "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=6164,i,14756419903919070439,8656642546852403156,2097152 --field-trial-handle=2516,i,17468629787760928933,14481301124580882611,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2524,i,6783056266611350822,13967780379646763324,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=6232 --mojo-platform-channel-handle=6228 /prefetch:1
              4⤵
                PID:3888
              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=7480,i,16465188971150084800,18441594889095343616,524288 --field-trial-handle=2516,i,17468629787760928933,14481301124580882611,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2524,i,6783056266611350822,13967780379646763324,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7492 --mojo-platform-channel-handle=7488 /prefetch:14
                4⤵
                  PID:4772
                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=3776,i,11894532220193329264,7964967688635173295,524288 --field-trial-handle=2516,i,17468629787760928933,14481301124580882611,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2524,i,6783056266611350822,13967780379646763324,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=7904 --mojo-platform-channel-handle=7900 /prefetch:14
                  4⤵
                    PID:5496
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=2720,i,14939897637158148935,4295907741191852316,524288 --field-trial-handle=2516,i,17468629787760928933,14481301124580882611,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2524,i,6783056266611350822,13967780379646763324,4 --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=3888 --mojo-platform-channel-handle=3860 /prefetch:14
                    4⤵
                      PID:1964
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=4008,i,939244746621182431,15664508965101124957,524288 --field-trial-handle=2516,i,17468629787760928933,14481301124580882611,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2524,i,6783056266611350822,13967780379646763324,4 --trace-process-track-uuid=3190708995682289984 --enable-logging=handle --log-file=8020 --mojo-platform-channel-handle=8024 /prefetch:14
                      4⤵
                        PID:2304
                      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.96.518" --metrics-shmem-handle=1524,i,8845544135294956703,4027396946599716119,524288 --field-trial-handle=2516,i,17468629787760928933,14481301124580882611,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2524,i,6783056266611350822,13967780379646763324,4 --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=8028 --mojo-platform-channel-handle=7892 /prefetch:14
                        4⤵
                          PID:1920
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:5452
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                      1⤵
                        PID:4908
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                        1⤵
                          PID:4720
                        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
                          1⤵
                            PID:2768
                            • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                              C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.96.518 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ffcd93f5448,0x7ffcd93f5454,0x7ffcd93f5460
                              2⤵
                                PID:2440

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  index

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index
                                  • Size 24B
                                  • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                  • MD5 SHA1 SHA512

                                  the-real-index

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
                                  • Size 72B
                                  • SHA256 ece9944ca7d0ca209fa0d42382cd2be8a2148053ede7cc954b93a6645ef22f99
                                  • MD5 SHA1 SHA512 TLSH

                                  the-real-index~RFe5a548a.TMP

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe5a548a.TMP
                                  • Size 48B
                                  • SHA256 0ff3871276916dcabf0f901de5e0f5d0945d0a5d788d96a99068aa853f32537e
                                  • MD5 SHA1 SHA512

                                  data_0

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
                                  • Size 8KB
                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                  • MD5 SHA1 SHA512 SSDEEP

                                  data_1

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
                                  • Size 264KB
                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                  • MD5 SHA1 SHA512 SSDEEP

                                  data_2

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP

                                  data_3

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP

                                  Network Persistent State

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
                                  • Size 2KB
                                  • SHA256 95d1ef670aa5ac0d4a52e95f2aca95947f2a7c78b442d7fdbbcded3e54eda168
                                  • MD5 SHA1 SHA512 TLSH

                                  Preferences

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
                                  • Size 10KB
                                  • SHA256 6fb58de5cf47f8ae9a45d8a9a22ef5ff6e0748ea77bf58fd6b86921a4052ca53
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Preferences

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
                                  • Size 10KB
                                  • SHA256 c1dab520204c7a0091cc6c31661d3ea0dfef5dcdd2ee197ef9e817cca05ddf76
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Preferences~RFe5a83b8.TMP

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe5a83b8.TMP
                                  • Size 10KB
                                  • SHA256 11bab3002a7250f6774e730d45db2565774d827a4accd03a8d07ac8d204b5019
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  121994f4-493c-4bd6-ad98-bedb0353f054.tmp

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Default\121994f4-493c-4bd6-ad98-bedb0353f054.tmp
                                  • Size 8KB
                                  • SHA256 d366b01c741a74a271b730f953bdeb75b12beda553ec57920f11d1ef7e2f090d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  MANIFEST-000001

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512

                                  Network Persistent State

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
                                  • Size 922B
                                  • SHA256 d965b355ca99ce70ef5db472259aff30c734f0d2cfbeb47f7ff6dba847584ae1
                                  • MD5 SHA1 SHA512 TLSH

                                  Network Persistent State

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
                                  • Size 59B
                                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                  • MD5 SHA1 SHA512 TLSH

                                  SCT Auditing Pending Reports

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512

                                  Preferences

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
                                  • Size 8KB
                                  • SHA256 3d538501df25fd3ecc47166ec9cb3e0b02ce4170d57f4539afaeb2a3944463f2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  CURRENT

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512

                                  Local State

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                  • Size 3KB
                                  • SHA256 33033cb1dd7578c7e293b2869179341ccf17b9158d2b6bc9822348df2a8af0dd
                                  • MD5 SHA1 SHA512 TLSH

                                  Local State

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                  • Size 6KB
                                  • SHA256 314a59f0f7d421cd8fd7351887e94ae79c077739fd12c968d1788973061f2f69
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Local State

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                  • Size 6KB
                                  • SHA256 f04d6123dd605c08af324cbdf54fe46b718f10734521016f0ff1819f393aaa9f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Local State~RFe5a0679.TMP

                                  • Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe5a0679.TMP
                                  • Size 1008B
                                  • SHA256 41eca92280a542d8a4f1b33bc32708319597f41568037e4b4772eac6c7561043
                                  • MD5 SHA1 SHA512 TLSH

                                  settings.dat

                                  • Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
                                  • Size 56B
                                  • SHA256 d9fa7d2994280243f2066f292710449ac776ce704f9e8f3b05a54eb7cfddf9cf
                                  • MD5 SHA1 SHA512

                                  metadata.json

                                  • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                  • Size 236B
                                  • SHA256 8bf7833c11ce7a85626ee59b89c0d490f619cf5f8f9f41948b5ecc0f4c37ffa7
                                  • MD5 SHA1 SHA512 TLSH

                                  metadata.json

                                  • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                  • Size 348B
                                  • SHA256 6dd2993eb2de08db2571ee4fb8c02fccdef9b8803373aed7a3043dd94ff4e262
                                  • MD5 SHA1 SHA512 TLSH

                                  metadata.json

                                  • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                  • Size 124B
                                  • SHA256 418e37a64c865013c87c6d30e5094d292fa74fb46e449d968ac83f492e46407b
                                  • MD5 SHA1 SHA512 TLSH

                                  8d27619e-07f6-4b3c-8d60-1c35571412e4.tmp

                                  • Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\8d27619e-07f6-4b3c-8d60-1c35571412e4.tmp
                                  • Size 13B
                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                  • MD5 SHA1 SHA512

                                  000002.dbtmp

                                  • Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
                                  • Size 16B
                                  • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                  • MD5 SHA1 SHA512

                                  login.spa

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
                                  • Size 3.9MB
                                  • SHA256 ab20e5730ce3e31c1b8f0ba62fab40a20205d9faf2c8c748d0f02330c181609b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  D3DCompiler_47.dll

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll
                                  • Size 4.5MB
                                  • SHA256 3b01ff1bc4a18b63a790c5f6de8e17573de4c5280570ad8677a7767fad304af2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Spotify.dll

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
                                  • Size 40.5MB
                                  • SHA256 e3fb0cf4b033c7fd689e5a1486c3fec298c263f73868b6085ab4671b35ad538d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Spotify.exe

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  • Size 2.8MB
                                  • SHA256 31a16d06a39339c3b9befef9089b17e4a45b946bccae668b569157ee244b2a7c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  chrome_100_percent.pak

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
                                  • Size 705KB
                                  • SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  chrome_200_percent.pak

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
                                  • Size 1.2MB
                                  • SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  chrome_elf.dll

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                                  • Size 2.4MB
                                  • SHA256 24eafefff6b2d53bc408ee41b0607229c111afa07dbdc04d71ad5a25b43027c2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  crash_reporter.cfg

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
                                  • Size 632B
                                  • SHA256 33f70749cdc5ecd6bb047147a2e767d7a279c631f6524ebb1b1df60e6bf93d6e
                                  • MD5 SHA1 SHA512 TLSH

                                  icudtl.dat

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
                                  • Size 10.3MB
                                  • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  libegl.dll

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll
                                  • Size 504KB
                                  • SHA256 f9ee6e166b95763900af0937ada47b11c5d1129f49f7dfeadaa18fb10d0b1efd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  libglesv2.dll

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll
                                  • Size 7.5MB
                                  • SHA256 630a0e4217d83078b074a1d66e4a4723f9e4f310b24ba0e6a8c3092837b851d1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  en-US.pak

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
                                  • Size 577KB
                                  • SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  en.mo

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
                                  • Size 16KB
                                  • SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  zh-Hant.mo

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
                                  • Size 16KB
                                  • SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  resources.pak

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
                                  • Size 17.8MB
                                  • SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  v8_context_snapshot.bin

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
                                  • Size 16.8MB
                                  • SHA256 148fb1b705a31315ee286cfc344c9e0279d0cd43d386ae4f381e7846a34e434b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  vk_swiftshader.dll

                                  • Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
                                  • Size 5.2MB
                                  • SHA256 a92fba6360ddc71779d8ec480f21d4959f5f6c10db24741e19c6ddb0d6ffe85e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  memory/1920-917-0x000001DDD5D20000-0x000001DDD5DC8000-memory.dmp

                                  memory/1920-916-0x000001DDD5C90000-0x000001DDD5D04000-memory.dmp

                                  memory/1964-860-0x000001F761770000-0x000001F7617E4000-memory.dmp

                                  memory/1964-861-0x000001F7617F0000-0x000001F761898000-memory.dmp

                                  memory/2304-900-0x000002B4CD5D0000-0x000002B4CD644000-memory.dmp

                                  memory/2304-903-0x000002B4CDC20000-0x000002B4CDCC8000-memory.dmp

                                  memory/2768-631-0x000001BA51800000-0x000001BA540B4000-memory.dmp

                                  memory/3360-678-0x000001C8033E0000-0x000001C803488000-memory.dmp

                                  memory/3360-677-0x000001C803360000-0x000001C8033D4000-memory.dmp

                                  memory/3360-418-0x00007FFCF5FA0000-0x00007FFCF5FA1000-memory.dmp

                                  memory/3360-419-0x00007FFCF6C70000-0x00007FFCF6C71000-memory.dmp

                                  memory/3888-683-0x000001FE5D6B0000-0x000001FE5D724000-memory.dmp

                                  memory/3888-684-0x000001FE5D730000-0x000001FE5D7D8000-memory.dmp

                                  memory/4772-655-0x000002694C3E0000-0x000002694EC94000-memory.dmp

                                  memory/5052-841-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-727-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-633-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-780-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-939-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-341-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-634-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-803-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-904-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-871-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-758-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-343-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-660-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-721-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5052-715-0x000001D7FBF80000-0x000001D7FE834000-memory.dmp

                                  memory/5352-753-0x0000012C0D2C0000-0x0000012C0FB74000-memory.dmp

                                  memory/5352-676-0x0000012C0D2C0000-0x0000012C0FB74000-memory.dmp

                                  memory/5496-778-0x00000229D89B0000-0x00000229D8A58000-memory.dmp

                                  memory/5496-777-0x00000229D82D0000-0x00000229D8344000-memory.dmp