718ba1cb98b42de2c4609953531e6b255e31ca31fd3645cb98b2ca040763fea3

Analysis

user interaction
yes
max time kernel
26s
max time network
90s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpotifySetup.exe
Size 1.2MB
Sample260908-cb94eazdmc
SHA256 718ba1cb98b42de2c4609953531e6b255e31ca31fd3645cb98b2ca040763fea3
MD5 884e2b49b20437f0f543b5ba79a61752
SHA1 c1e5089dc7fb85485f821fe6ce5b0a3a5fb97bc5
SHA512 3bf199b6907d1dd54d67b34bfaa633b59d6ead249aec16918bae36c8e2eefc61607aa8f41bebb5ab406d96ff6e01f2a84bacb92bca617e23c5d18d76cbd43747
SSDEEP 12288:S1hE8IcIrFEP48eZx5PpQsM4F5nLYU8ygnAgoF540B7DTSFi14ju:S128nIr2P48i5PpQJ4FNLYc76u
TLSH
T1D9555C895B28D6AEE363D17D4021D139E6717C220FD1924A42F9A2FC1E7B334796BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	1672	SpotifySetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
6060	SpWebInst0.exe
724	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3544	Spotify.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\AppUserModelId\Spotify.desktop.launcher	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\AppUserModelId\Spotify.desktop.launcher\DisplayName = "Spotify Launcher"	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\AppUserModelId\Spotify.desktop.client	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\AppUserModelId	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\AppUserModelId\Spotify.desktop.client\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\AppUserModelId\Spotify.desktop.client\DisplayName = "Spotify"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\AppUserModelId\Spotify.desktop.launcher\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\AppUserModelId\Spotify.desktop.launcher\CustomActivator = "{18A68F64-72DD-42CE-A75D-EDBDAC226F5D}"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\AppUserModelId\Spotify.desktop.client\CustomActivator = "{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}"	SpWebInst0.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 6060	1672	SpotifySetup.exe	89
PID 6060 wrote to memory of 724	6060	SpWebInst0.exe	90

C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe
"C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe /INSTALLCOMPLETE
    3⤵
    - Executes dropped EXE
    PID:724
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.99.317 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7fffc0995448,0x7fffc0995454,0x7fffc0995460
      4⤵
      PID:6032
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.99.317" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2160,i,7629682558775139668,12392039419764083585,262144 --field-trial-handle=2560,i,4856919516636225724,15062591234710516571,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2564,i,9839362260630606800,5558793199815940414,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2568 --mojo-platform-channel-handle=2556 /prefetch:2
      4⤵
      PID:4480
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.99.317" --metrics-shmem-handle=2428,i,800451379779482590,8372718556385457089,524288 --field-trial-handle=2560,i,4856919516636225724,15062591234710516571,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2564,i,9839362260630606800,5558793199815940414,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2600 --mojo-platform-channel-handle=2596 /prefetch:11
      4⤵
      System Time Discovery
      PID:3544
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.99.317" --metrics-shmem-handle=2924,i,8776115524321322333,4052339078890273288,524288 --field-trial-handle=2560,i,4856919516636225724,15062591234710516571,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2564,i,9839362260630606800,5558793199815940414,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=3112 --mojo-platform-channel-handle=3108 /prefetch:13
      4⤵
      PID:4368
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.99.317" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=6176,i,1998438221743898131,5044206353396509797,2097152 --field-trial-handle=2560,i,4856919516636225724,15062591234710516571,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2564,i,9839362260630606800,5558793199815940414,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=6236 --mojo-platform-channel-handle=6232 /prefetch:1
      4⤵
      PID:2880
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.99.317" --metrics-shmem-handle=7668,i,13543582630921105224,8393951768708157401,524288 --field-trial-handle=2560,i,4856919516636225724,15062591234710516571,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2564,i,9839362260630606800,5558793199815940414,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7676 --mojo-platform-channel-handle=7672 /prefetch:14
      4⤵
      PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5768

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
1⤵
PID:4620
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.99.317 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7fffc0995448,0x7fffc0995454,0x7fffc0995460
  2⤵
  PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_0

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Spotify\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 2a7850a0f8bb87b2a109efb5cc5bfc43230ed3a836b0e019ca16623a08c042ea
MD5 88f7dcae79427a3963ef5520222157bc
SHA1 7161f6ac7e15addf09910362cdcf6d35d0bb35f3
SHA512 16176741c56073c815cfd901946780d0f9d958a943de0af4b5f10a00a777bad3037aa79bff7a7b737723e02c32de0824e0c90e3f123d8c6b664a09e7c415819b
SSDEEP 6:/M/LlE/2qQhXSvDozuSezuSeGLIiv8KLmjgfRfr3Or3O3B9ZKBx:U/eQhivDLpqp9ikzUfRzere3Cx
TLSH
T13C44C2FB6604520AD390DBF98143B27C857366183CEF6BCBD57084A25840E2B20A40C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Spotify\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 3KB
SHA256 477575f1c2880d2dce8f613b5701a551f4dc8d23c3dd8a4c524fc27c28dc083c
MD5 bb39674dc028f38f4e662e5f442732b7
SHA1 cb32d281dd92fac44495b24d1f403ac101094cf3
SHA512 e87b49c76646e60e26385214d9b2fe0a6ee5b03bbbbf152c41e53d1a097d607394466e29dff1814de226912d32c64cfd7bc90c672d9dbedbae1b1f24e665a9d9
TLSH
T12061962168B89DB759BBD444F5032A43EBA82117A264BFD8E5FD4E1C04FB5EC2353507
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a68dd.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe5a68dd.TMP
Size 1008B
SHA256 2cd1d49cdbd2226156356abda54bafbf211f9ea7fccf1e8d4f0d863ba2800532
MD5 8c6aede8ad73fd5f76104a401ace0813
SHA1 a212608b28d393e9520083d1a6806f96febbfcb9
SHA512 ad6c1ae645361f41dde69efd8803461f3486cdbfa463d4a16431ced9eb5e84b87043abb3271daaa59117498e97e301abf34a53d4631bc097efb152e48c92f969
TLSH
T11E1194F278A09AF2BFD4A6A473032B534E28513681954E8C72DD222A15BF4A83312832
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Size 56B
SHA256 6bce5ebc518b37224e00649567cdb3827b8faeca9ccd7389bc53619646e51cbd
MD5 4424f9f4fe1170439a6462ab77541952
SHA1 fe9b696e50c33f647f0ea5bda85d6c287815b4a5
SHA512 59537d098fc0c0873d68e79c9791cdb053a2041c9d42db2b6e480b971a5aaca6759dd9f32d2d1c91c86ffde432155d779e25ac7406ea5aebed7a3622d56a42e3
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
Size 3.9MB
SHA256 ac5a8494192b0c745677606db03c6514d02250761951f62ca36f019e0dc72b58
MD5 0338cac4c2958d48fabc648eded4f9c3
SHA1 4beef70cc3178156e06c51ae9d9b2dfd646dddbb
SHA512 8adb31248dd51603593caef266aad9ebe5c7aeeb117762c224a751b6304a770869ca38c1c4c551eb79a7a1f556e65fa3028f24c10aad8a5debf7f6a328c709a9
SSDEEP 98304:ghMjx0BSTbSEDHsE/fxmAYVUR4mi8/YoqM6se9VZnCWN7ABF:yMjjfDHsEHx6ZyrZq97C47Av
TLSH
T12A16333882F71947C29F1634C7EC961AFAA625930E57FFAB7CD012B55A466D3C1B0A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.8MB
SHA256 660c8c2f2894b78e620df1b1af6b4ac8cee5a081eb7c434da16ee62b340ac11c
MD5 9413e4361eee60422cbe7aaeecedd224
SHA1 ece8a1d00c0c8a8f14e7e9a1e0a6ffee2a023ce1
SHA512 28c9d785dca9e522b0e622bd6e43f64b7ae2042304ac80f25271a371db13130489849605a1c54239fcd4332fb9305dac00ffcd4f5510af0ff099003848d9bc01
SSDEEP 393216:s6+HlnAnq6k4sCX1pYLOgy9zpQW6p3B0yNUzIBIJlXr+lpG3QcpG0:s96x0LYwBAXr+Vcp
TLSH
T1FC979DAA71E401ECC0AEE1BACB17DD17E7B7748A4731E34F02A482A25F67620563F751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 32.7MB
SHA256 b3b9e6319c963a6c86a4fd8bb5df4f1ab4e38deb5ccf4a669c97a403efb402d8
MD5 b31c94b66cf7487c08a4b1afa545eaca
SHA1 818e25c4d1e30466be8a322956d4706af5c30260
SHA512 96e2e6083f7e6d38810ebfd9448056504250187cc3b091b80423b25e38a805f02e772163d2a5f8e11a94db2da9acad82d98cefd7abf6df690b97b2ea49e84223
SSDEEP 393216:s6+HlnAnq6k4sCX1pYLOgy9zpQW6p3B0yNUzIBIJlXk:s96x0LYwBAXk
TLSH
T1EF777DAA71A401ECC0FAD1BACF179D17D7B3344A4731E25F06E486A31F67A60563E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 340c6d121e2cf8ec89073f5e8e91fc0c37ced419064b4f19623f4fb7d36200aa
MD5 02b9f250ae8e1ac585648d932f9771fa
SHA1 064435b483cd259d6c8f54c83a5025545afddf72
SHA512 6922d7a9c69a15ffa7be0c9bdb55943c3de139bc4a33d3d1eeae2be320212e47311963850b54d68bb44fa330a7892adf53cb09289c266475fc0dd72d8fdad370
SSDEEP 49152:dHYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+diF:dHYg8xwfGrUA9Ncnas8jdE
TLSH
T15FD57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Size 705KB
SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
MD5 0321d6c44a6041910208ce3891727842
SHA1 42e8935bd94f0fa3fd8611fc84e25a06e8ba82ed
SHA512 6c9348ed4d50fb2503012b80c0dc8f4cf07d00d2ff857fff8c102266533e65befc6535998f9497fe414cd427dfaf0ff3e5cd1b586addba236b3794768e3d476c
SSDEEP 12288:bI3H1fJwhjzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnSzm5dVYJblIt6kjKQCrC:U3VBE7zEEmPL8bTe+gnSzm5d2bc6kGQt
TLSH
T1FCE412E77374AC7DEE9B1277826505B0FC371A681B82020A179BF8796913B48D8C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Size 1.2MB
SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
MD5 d995543b367f8675ba74b90f42790175
SHA1 ae7f07096d74d1565929fffbf1a9711a08fc74e1
SHA512 99018c2cd0685bcfc6de8d08a649515b606982f56f1dced3b5304c7358e74bb463aa89795752580abff98b288865b49720940f8f0707a5f2527457edda968685
SSDEEP 24576:i3zB09p2zLmmibkFR8+mZi5r8BWhQumeMRvQt93dyQwuSXAkpbaUGQ74:i3y23mNbkFRJmQ58khQRT1QPtauSXAkA
TLSH
T19E4522D7A370DC7DDD530BB7929B40F4FD7A106B0AB2140A0627BD7A39257889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 cb337e6a548cecd3c538945a00976d53844e3408806d5d815fb901b091fd78a8
MD5 4ae6f5ccae394507381b363fff009e52
SHA1 7702c3df5ec88336491803d6c0b2eede6180581a
SHA512 6bb4b839f3106e0d49ed8aa46d3fb851d6cff748e97fcaa100ae326efb07147a07fbab56e61bb0b64719cf52fc0290bb985c7d641e06b3fd83cc746137497caa
SSDEEP 49152:yLOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l1h:yqG2qe6JBKDtXmKjh
TLSH
T19BC56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 632B
SHA256 31059d6506ed1919fc71d820b2238644983af7213f5e106cd183ae61758e49ef
MD5 d12e9f035402d43f6f7089e7b34f0bf1
SHA1 d207e8406441cc54c3643ea61afa2dd6dc0df264
SHA512 67445604d0519fabf2801c6286879a54632577d15434efe59421f9cd2bbd041370d09a08b1e3b08405ad3c39e6e9d788816b0b68f6819c550eb949305e6de42d
TLSH
T1ACF02DFF59D0657994F10BA1D03C63107CB205951B2B805846531F993B48F69CE5DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
Size 4.5MB
SHA256 da68283aa7656602765d3c5bc1c9a0e23a5ce9aa555068e865917dc98fdffad0
MD5 abfb885b579529cdb9165f6b72ef3f5a
SHA1 de064cd9a9dd3bb025a28dfa0af6f54c279a500e
SHA512 f5e9ae502eb81044641a8df7d9cf1b6e7fe39708d92496609cc2fd4025e4b25d4811e548f45df0836458e2fc6f46122dccbd979f3907c2992e16e033d1b2218f
SSDEEP 49152:ZSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqr:8uktcrfNlTyj5byqSQ
TLSH
T17F268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
Size 504KB
SHA256 5022515bb0cde8d947e15a39084ac54590b4439e37696d1cce8fc167f3d8cbd1
MD5 9ef9cd5f7c637f5f962ab010d571801c
SHA1 854e33db3e0ea2a4279a43f659b753a9d0320df5
SHA512 114da46916497c34a2cf66ea7007be3dbe2bb44d135e2baa05319679524d7b05f039f45a922bc1305c99d7c62e6f8825a855e9db1aab55599cf9e1c062a9269f
SSDEEP 6144:bF1o4DAf5s1KStUkNbhk7Ak7KhPCcgoF0NKzdgbsQr7rVGCXoxg:x1o405CtUkBZk7K9CcgG0NWd/QDVGtg
TLSH
T150B48E15B3E94AACE07AC134CA438547EB7178460B61F6DF02E0A2792F77BE45B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll
Size 7.5MB
SHA256 3e133170d513f46aaffa6540cc39405798f5d3c4bed1d306967d95a0cae224e4
MD5 fefceefab1ca5e9cafc0212e68527220
SHA1 b47ce83b544b548827994a2554af7fa23a8bcb8d
SHA512 b00e033840bd3101d342a52bc5567bd8ce7621fdc38f5bf156b8336c757602e5e30507c7e91a37b1c7cd67220c34ad7963e434d79a6e7916177c7ff0c86b9605
SSDEEP 49152:4tvLjzlN4kFextqcusm4nHcpOjwrMQOT6n1SSCOQESgswJYgZc+5GTSpWy4EWT5M:WWusNpjgKle2S+E8Nkpp0ve9fPzFj
TLSH
T1BC867C13F69240DDC01DE2B8975B9223F778B8450764B2CF2A5453162FBAFE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Size 577KB
SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
MD5 2a1964ff31c7edff17f4c74d26fce378
SHA1 2c66f52ac23828ec6a18a6720ebfcb275482edcb
SHA512 fbb19f906ab8f61461c8be80d53a7cadddfe81524918171c0bfab45f9cec2f5c045ff7ff864858f5c087d4b05c585ba58dfdb7565302605efc524f388c241ba0
SSDEEP 6144:WpcHQYHQbmpKwey1WMmHfYOMg/jSxMP9sQqblfaYQhp1BPOjnng98//gwb:wwQKAGMDHfdgM6Qqbgaj+wb
TLSH
T117C42B1FF744122A05A352A27F099562FF32D06CA35112663CBD812C3376B6693BB7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Size 16KB
SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
MD5 8ce43bf0bee69290545738ae472bd5dd
SHA1 bbc36343250fa8bb2122c8af9e021fc80c032a0b
SHA512 67825fdb6c0381b7e35c73221caf37374157c1333388d0d20685f4d732340f7fc04faba29ae266fcaa921fff2694b5f8ca0ba24fbbdce2146189924e354df7a5
SSDEEP 384:5rg5RkIUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/neqA9oz+EFRUeLq4+lLbK74Tdu/:kgOXqEXqP
TLSH
T1DC72B89F1B21CA38E637477F6A5E3125EB3B805C4F91953419BBA44823C639603F71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-Hant.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
Size 16KB
SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
MD5 d41d181d619aef4a1af14bcd6ad2fc1c
SHA1 05ea268a59c887a92387a2ad2925285901bba1ba
SHA512 b2ed7c0c97672411266ef55cfed4e98a7d812e85a20706140c8ea8c566677ed9bdcfaac7d0656496e34db5a7a50e0c9e810fe9a18c2039630745ce617513b605
SSDEEP 384:pFTaUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/na5k+0SyIqLvsZXPuD:LxOXq+LBDXPuD
TLSH
T15E72175B1932CE38D5378B7E5B9F3624E63B612C5ED164342BEFB41423C636A16E2053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs

Path C:\Users\Admin\AppData\Roaming\Spotify\prefs
Size 154B
SHA256 ec7409dc427dffc856f0a37b360ab7af898733551b320e907285749a6b2a54f8
MD5 9a3e3783017f0bf9985f0b65241690ef
SHA1 e397fb0b85a169e1d5e060c0ba0765f5f3593c23
SHA512 19e4a5c14d5f09734b21fe52bc9b019d7b9b100f91169280f48a610743cdf8fcc367ce34071b41f94f932b18a82f99be21fbb970c10bfa2517ed9099e9fc334e
TLSH
T106C08C8AB803EB30ACD00A8DD6167201C170388DB0CE5A05892301082D8EB1CAA17256
MD5 SHA1 SHA512 TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Size 17.8MB
SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
MD5 c6c9a3d440e436b8c28867f3c3955ce9
SHA1 208847cb98181e6ba434dd5ec17d686824604946
SHA512 2e1d53d773f57cf8c311674d60615602670d44af7a7545c60172ebbd47d6bb32e382c4cc91a5394fc1a51dab4b654be822f81f1ea963ec1176624b0bea6a6f1a
SSDEEP 393216:pqX9UazcYdpnzyXm++SSSCZMwh56qAgbITfTK3l76TmkrqjFWBm0iw+X:pqtJzcYnzoN+wCW4AAITG3lVkMgmeI
TLSH
T10A17124BA758562BCE3F07B74652563F373091197F835307209283281C6A7FBAD8DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Size 17.0MB
SHA256 06eec0169b635a18317eccc676001a6179ea0eabe3a078945500ee2b7e6cbd88
MD5 5d019b950f58065b6df357a7fda3ec53
SHA1 70030cbf9c7d369ea4034ec206a771a98f34f8e9
SHA512 8cb356ca476effbe640945b6d95443c6068ae7a152474869f71376bf33a64975dc7249aee050df5875a2464b7be434b3f281d4a110812895a896c6307d7b113a
SSDEEP 49152:oaKGh60mK9xDoOGHUQKQCBVi+VnZnHRyoLqFsdSAMjyaWnPC:mjy3K
TLSH
T1B7074680E7F95348F2F77F65EEBA90564836BE96ED29C75E0405050E0831A4C99BAF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Size 5.2MB
SHA256 8ab4c7a81e06974faf10c083c8fc25dc11a8b57486dac25e66df2350d593d841
MD5 d2e34d543d8c7813bf00ceb8b654b5c7
SHA1 e1b47c9a3e5801625529cf4e54108104c12e63c2
SHA512 06f1709125bc818c027728f1482ec64ed652065db4bf94059d864c7d5be8caf227a6247d911c722378e876f19e0309c0fc6770d9f2c1624896d1a308c97a6c94
SSDEEP 98304:z4ydZOjlb3GaE1COMOIFGOOOOOOOOOOOOqLOOOOOOOOOOG:UlC09GOOOOOOOOOOOOqLOOOOOOOOOOG
TLSH
T14A463803F19680E9C06DD579875EA623B632F8840B3676DF66A00F1A2E79FE0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/724-352-0x00000195185D0000-0x000001951AED2000-memory.dmp

Download

memory/724-343-0x00000195185D0000-0x000001951AED2000-memory.dmp

Download

memory/724-342-0x00000195185D0000-0x000001951AED2000-memory.dmp

Download

memory/724-607-0x00000195185D0000-0x000001951AED2000-memory.dmp

Download

memory/724-613-0x00000195185D0000-0x000001951AED2000-memory.dmp

Download

memory/724-655-0x00000195185D0000-0x000001951AED2000-memory.dmp

Download

memory/724-685-0x00000195185D0000-0x000001951AED2000-memory.dmp

Download

memory/724-687-0x00000195185D0000-0x000001951AED2000-memory.dmp

Download

memory/1496-672-0x0000012A7BF20000-0x0000012A7E822000-memory.dmp

Download

memory/3544-608-0x000002A7FB700000-0x000002A7FE002000-memory.dmp

Download

memory/4368-404-0x00007FFFCEB80000-0x00007FFFCEB81000-memory.dmp

Download

memory/4368-403-0x00007FFFCEB70000-0x00007FFFCEB71000-memory.dmp

Download

memory/4620-574-0x00000238860A0000-0x00000238889A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads