852554df89308c02b10e1793933febeedee1b53ed34d49a525750471750c37bf

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_08416e291dc04449090d422266c89683_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe
Size 4.5MB
Sample260925-twh9vs1bqa
SHA256 852554df89308c02b10e1793933febeedee1b53ed34d49a525750471750c37bf
MD5 08416e291dc04449090d422266c89683
SHA1 b14973896124ecf557dd917cbd486c823a1b3205
SHA512 bb84a920efc4cfb23e331e4078cd140064033fcea7d8ff34f2a09a7b255a46b4173fc55aa452ff5e24218b15171231c18ef6dd905a6d3e04093147cc37107c33
SSDEEP 49152:UeZvsEI6ff9/4hpzqx3xZd/wlzki4P4BDMlStRrLqs46Tyaag7ECnjj0sl2:UeyP4FJ/w6IBDMoLyaakOs
TLSH
T18E269E56BDA4C8E9C25BD2798972C5A2BB30BC050B7263D7169072B83F777D06D7AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	2972	wrapped-2733673162.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 17 IoCs

pid	Process
2972	wrapped-2733673162.exe
5076	wrapped-2422942439.exe
4460	SpWebInst0.exe
2780	Spotify.exe
5804	Spotify.exe
200	Spotify.exe
4188	Spotify.exe
4200	Spotify.exe
3552	Spotify.exe
6016	Spotify.exe
3772	Spotify.exe
3884	Spotify.exe
2260	Spotify.exe
1444	Spotify.exe
124	Spotify.exe
5008	Spotify.exe
5824	Spotify.exe

Loads dropped DLL 46 IoCs

pid	Process
2780	Spotify.exe
5804	Spotify.exe
2780	Spotify.exe
2780	Spotify.exe
2780	Spotify.exe
200	Spotify.exe
200	Spotify.exe
200	Spotify.exe
4188	Spotify.exe
4188	Spotify.exe
4200	Spotify.exe
4200	Spotify.exe
4200	Spotify.exe
4188	Spotify.exe
4188	Spotify.exe
200	Spotify.exe
200	Spotify.exe
200	Spotify.exe
200	Spotify.exe
3552	Spotify.exe
3552	Spotify.exe
3552	Spotify.exe
6016	Spotify.exe
3772	Spotify.exe
6016	Spotify.exe
6016	Spotify.exe
6016	Spotify.exe
3884	Spotify.exe
3884	Spotify.exe
3884	Spotify.exe
3884	Spotify.exe
2260	Spotify.exe
2260	Spotify.exe
2260	Spotify.exe
1444	Spotify.exe
1444	Spotify.exe
1444	Spotify.exe
124	Spotify.exe
124	Spotify.exe
124	Spotify.exe
5008	Spotify.exe
5008	Spotify.exe
5008	Spotify.exe
5824	Spotify.exe
5824	Spotify.exe
5824	Spotify.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\Spotify = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --autostart --minimized"	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_1060951329\manifest.json	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_1060951329\LICENSE	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_393388391\manifest.json	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_BITS_2780_2107590007\decoded_xz	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_2008825015\safety_tips.pb	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_2008825015\manifest.json	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_1288071601\privacy-sandbox-attestations.dat	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_1288071601\_metadata\verified_contents.json	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_1060951329\keys.json	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_1060951329\_metadata\verified_contents.json	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_393388391\optimization-hints.pb	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_393388391\_metadata\verified_contents.json	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_2008825015\_metadata\verified_contents.json	Spotify.exe
File created	C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2780_1288071601\manifest.json	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wrapped-2733673162.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wrapped-2733673162.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Spotify.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Spotify.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Spotify.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Spotify.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wrapped-2422942439.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wrapped-2422942439.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Spotify.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Spotify.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4188	Spotify.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Spotify.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\spotify\shell	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\AppUserModelId\Spotify.desktop.client\CustomActivator = "{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\AppUserModelId\Spotify.desktop.launcher\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" -ToastActivated"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\AppUserModelId\Spotify.desktop.client	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\AppUserModelId\Spotify.desktop.client\DisplayName = "Spotify"	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\AppUserModelId\Spotify.desktop.launcher	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\AppUserModelId\Spotify.desktop.launcher\DisplayName = "Spotify Launcher"	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\CLSID	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\AppUserModelId\Spotify.desktop.client\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\AppUserModelId\Spotify.desktop.launcher\CustomActivator = "{18A68F64-72DD-42CE-A75D-EDBDAC226F5D}"	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\AppUserModelId	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	Spotify.exe
2780	Spotify.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe
Token: SeShutdownPrivilege	2780	Spotify.exe
Token: SeCreatePagefilePrivilege	2780	Spotify.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2780	Spotify.exe
2780	Spotify.exe
2780	Spotify.exe
2780	Spotify.exe
2780	Spotify.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2780	Spotify.exe
2780	Spotify.exe
2780	Spotify.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 2972	3404	2026-09-23_08416e291dc04449090d422266c89683_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe	91
PID 3404 wrote to memory of 5076	3404	2026-09-23_08416e291dc04449090d422266c89683_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2972 wrote to memory of 4460	2972	wrapped-2733673162.exe	93
PID 4460 wrote to memory of 2780	4460	SpWebInst0.exe	94
PID 2780 wrote to memory of 5804	2780	Spotify.exe	95
PID 2780 wrote to memory of 200	2780	Spotify.exe	98
PID 2780 wrote to memory of 4188	2780	Spotify.exe	99
PID 2780 wrote to memory of 200	2780	Spotify.exe	98
PID 2780 wrote to memory of 4200	2780	Spotify.exe	100
PID 2780 wrote to memory of 4200	2780	Spotify.exe	100
PID 2780 wrote to memory of 3552	2780	Spotify.exe	103
PID 2780 wrote to memory of 3552	2780	Spotify.exe	103
PID 6016 wrote to memory of 3772	6016	Spotify.exe	107
PID 2780 wrote to memory of 3884	2780	Spotify.exe	110
PID 2780 wrote to memory of 2260	2780	Spotify.exe	113
PID 2780 wrote to memory of 2260	2780	Spotify.exe	113
PID 2780 wrote to memory of 1444	2780	Spotify.exe	114
PID 2780 wrote to memory of 1444	2780	Spotify.exe	114
PID 2780 wrote to memory of 124	2780	Spotify.exe	115
PID 2780 wrote to memory of 124	2780	Spotify.exe	115
PID 2780 wrote to memory of 5008	2780	Spotify.exe	116
PID 2780 wrote to memory of 5008	2780	Spotify.exe	116
PID 2780 wrote to memory of 5824	2780	Spotify.exe	117
PID 2780 wrote to memory of 5824	2780	Spotify.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-09-23_08416e291dc04449090d422266c89683_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_08416e291dc04449090d422266c89683_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\wrapped-2733673162.exe
  C:\Users\Admin\AppData\Local\Temp\wrapped-2733673162.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
    SpWebInst0.exe /webinstall
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      Spotify.exe /INSTALLCOMPLETE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Enumerates system info in registry
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.3.1.234 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ffb4b9a5448,0x7ffb4b9a5454,0x7ffb4b9a5460
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5804
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2228,i,1676820450945474114,8679073925292451301,262144 --field-trial-handle=2512,i,2395124284632342215,2526556834177810957,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2516,i,13346337108546259000,6155619737384911041,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2520 --mojo-platform-channel-handle=2508 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:200
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=2476,i,739924681772926672,17319585518773013713,524288 --field-trial-handle=2512,i,2395124284632342215,2526556834177810957,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2516,i,13346337108546259000,6155619737384911041,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2584 --mojo-platform-channel-handle=2580 /prefetch:11
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Time Discovery
        
        PID:4188
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=2908,i,12162493656224232216,14616331967020401400,524288 --field-trial-handle=2512,i,2395124284632342215,2526556834177810957,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2516,i,13346337108546259000,6155619737384911041,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=3088 --mojo-platform-channel-handle=2848 /prefetch:13
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4200
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=6108,i,12141375720555616538,11941555790250784262,2097152 --field-trial-handle=2512,i,2395124284632342215,2526556834177810957,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2516,i,13346337108546259000,6155619737384911041,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=6176 --mojo-platform-channel-handle=6172 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3552
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7540,i,873772773966223454,7956404563675207007,524288 --field-trial-handle=2512,i,2395124284632342215,2526556834177810957,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2516,i,13346337108546259000,6155619737384911041,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7544 --mojo-platform-channel-handle=7536 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        
        PID:3884
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7572,i,3540319156838654943,3187503797237918154,524288 --field-trial-handle=2512,i,2395124284632342215,2526556834177810957,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2516,i,13346337108546259000,6155619737384911041,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=7532 --mojo-platform-channel-handle=7560 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2260
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=3872,i,17016011766142952518,7060877607155459977,524288 --field-trial-handle=2512,i,2395124284632342215,2526556834177810957,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2516,i,13346337108546259000,6155619737384911041,4 --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=7564 --mojo-platform-channel-handle=3760 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1444
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=8000,i,5164499388429721737,16640931661079573175,524288 --field-trial-handle=2512,i,2395124284632342215,2526556834177810957,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2516,i,13346337108546259000,6155619737384911041,4 --trace-process-track-uuid=3190708995682289984 --enable-logging=handle --log-file=7288 --mojo-platform-channel-handle=1328 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:124
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=8028,i,7795807196487704945,8060223715719989395,524288 --field-trial-handle=2512,i,2395124284632342215,2526556834177810957,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2516,i,13346337108546259000,6155619737384911041,4 --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=3876 --mojo-platform-channel-handle=8040 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5008
    - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        
        "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7572,i,12921789259963833547,9338461405118444940,524288 --field-trial-handle=2512,i,2395124284632342215,2526556834177810957,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2516,i,13346337108546259000,6155619737384911041,4 --trace-process-track-uuid=3190708997556373682 --enable-logging=handle --log-file=3760 --mojo-platform-channel-handle=8076 /prefetch:14
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5824
- C:\Users\Admin\AppData\Local\Temp\wrapped-2422942439.exe
  C:\Users\Admin\AppData\Local\Temp\wrapped-2422942439.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:5076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5228

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.3.1.234 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ffb4b9a5448,0x7ffb4b9a5454,0x7ffb4b9a5460
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 abc251caedd6cdc998005041ec5c0898cf0d4aaea37628f0ea0fd5953f16002e
MD5 b3f3f1ba66fb4f659944ff12d39be953
SHA1 71613b633c8a5061c2a6a0f605d72223aebd32be
SHA512 728f1c02c0cfe8c3918b159ccceefe4c6b34257547aaf2e51dfa14503c9828ecc76e44afd66012be185cf7f2cfb673dec19d354238fee2d10b841c42f1305561
TLSH
T1DAA002A05699C443C6C26BFB20424AD73255DF180B15070E90A0E498CD5564F4351244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5af399.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe5af399.TMP
Size 48B
SHA256 880ee5801c82f8bc525abee2e74906b4e2358da5dbfcb433ba295a78a2bb22eb
MD5 510a3a70a349a02fa1d46ef2cbdda219
SHA1 1964c7fdc5fc02e7e2f2f38a0878d9b10badc7bc
SHA512 c9d00c0230dbaa62d334cac8532bf123548c077f4c029d5bf2c052ef2a177824712a74ea2b83400b8e5c83ac29beb19bd99f5cd7563b2153d7a308d34629125b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Spotify\Browser\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
Size 2KB
SHA256 8bcf73b502de557118de62c2081c39f8cfe05611997ac8c6ad9371cd3a102328
MD5 e40ab00a206a0b7e430e722d6df9873a
SHA1 59c4817ed6d966455c182b526ecbbc6e27df8b1f
SHA512 83bff932f26eb4266e3f6bd305aedd0abe5401d00e9055163a27d025f9bc3d5b8ea927f3cceb1f67caa3c642f1ceb7447383caa76e83bf5db5400e6a8df60942
TLSH
T1B54188A3C3D9D63CD94116F497583E1BCE2E0A24832C3D26C9EABE1B63E2575E20114E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
Size 10KB
SHA256 eddeeff91a72a6387a031297e24347d8bb4c0594616986147128439dadaa74ad
MD5 f1c0c93dd9f1a994ab0bcbb4d1e65d58
SHA1 c0028ddad148413cd6703ad6bb93bb0397da9b6c
SHA512 e9e2095cbd458e4b05fd494624f58b594db149adfc1e755cacd49632437750dd5af67b101ff7be0762a2ee2e7224c94978897ccbadcfa0138d25a16e386a0565
SSDEEP 192:zRzZ1gmv7pk4z9PHcb+WNV6p6qd65ky85B/yIsn2Kgu:zRd1V3Fgspu
TLSH
T19022B42EE960657B6CCBD22AF9657B57E3F9502524902E84E7FCCB2C15E76CC2123403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
Size 10KB
SHA256 2347159594f1db5a1523b33d90e914c3e0767c4647231b1dd9c9fda39e899670
MD5 214f629f3f04b3f6656b20f6197b957e
SHA1 89010b3e5d1a29023b80a2a218c027944d97b0ca
SHA512 55dfb567a7606addc6968729b6c76625afd193755bcb703434751f0ac55a975888b800050c7b17e340228e89b6357da82f0717354f6ef72ff9ca51e330cca0e3
SSDEEP 192:zRzZ1gmv7pY4z9PHcb+WNV6p6qd65ky8SB/yIsn2KgR:zRd1VXFgs8R
TLSH
T1EF22A32EEA64657B6CCBD22AF9647B57E3F9402524902E88E7FCCB6C15D76CC2123407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
Size 10KB
SHA256 d82db2525f27490a73327c3f1f9b801ec91bf9da7fb84b2f7842cdbb215d2a5b
MD5 bc933b90cf91051e204ece1d3ad0fafe
SHA1 bb2e0a53e7b50f6f9701c142e6a603a309961c1e
SHA512 4dc80d161e1df3e10718cb503c5550e478e858e5d8a3fc6860b71a2b256671ad487918f49d996174fb448a0bce8ef3b2ec6babcfed57b19e7167ac6e298ffd6a
SSDEEP 192:zRzZ1gmv7pkpz9PHcb+WNV6p6qd65ky8qL/yIsn2Kgu:zRd1VSFgs8u
TLSH
T1D732B52EE960657B6CCBD22AF9657B57E3F9502124902E88E7FCCB2C15E76CC2123417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a8e57.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe5a8e57.TMP
Size 9KB
SHA256 98bf4d14edee112ddea2e0f0200ca4b67503e1f0ef347a317f9ec7750dfc765a
MD5 988cbf4c54d68710ccd27384fb4710a6
SHA1 a75e3f528ac0d6a33583d1bffdaa0baf16a36fe1
SHA512 b776f80257a99517e2290a399a9f0c8f29d9354d3b10458254a58612175c3d797f792d010abffd43c6c13171af35a14eec24963613a3466cec209b7d9f0d7e7d
SSDEEP 192:zRzZ1gmv7pr4z9PHcb+WNV6p6qd65ky8SD/yIsn2KgR:zRd1VkFgs8R
TLSH
T16B22A42EE964657B6CCBD22AF9657B07E3F9402524902E88E7FCCB6C15E76CC2123403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
Size 922B
SHA256 517e315ca77ea04c35573146bc1b3b6444ba4b078a2af0fac96a7a6d3c1da6c1
MD5 786120fb9e64d50e040f406d4d499ca8
SHA1 1300aa7d6412f6514b49ea92d7aaced0b52a1294
SHA512 02a735f3b1413bf1a1e5c8cf2e4160e184d07fa78b3a5fc1ae6234f9497b52a539e5ca68f573ef86de8b402e8d90700eba7e51ec8587e042edef2f64a2902daa
TLSH
T196119CF7C3D4852E8A4152F4A7106F1FCE2A0614431C3C26C9D8BF1B93E2876E11564F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
Size 7KB
SHA256 460cdafcd964f40c63329911c1bd4c658cba7534d52ed29fc8d36bf9e8ec76c2
MD5 b48543a91357c5849d1b043f89697502
SHA1 55ea7052e2045ce4b8cff095c9bb5c01056d844f
SHA512 3f65cfa43b3297ee6cddca1d2c6bbd3c1c825daf92e8c7d04b4b1f37eefb47f1039ac31bfd1a2fc6e38d39067df86dfc88a8c383e9c5f1960252190ce21ce6b3
SSDEEP 192:zRBgQdnv7hIa9VHcb+WNOVLqB/yIsn2Kg8:zRBg0pbgd8
TLSH
T115F1761EAD24667FACC6E659E9253B42E3F5502135943D48E7FCCA2C28E7ACC1237417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
Size 8KB
SHA256 f3959dda3a959257982c46d8d4bbfb4322ade9162049453391fea2819207b91f
MD5 701e7622c012f188a601395dac100b65
SHA1 1e66041e074d91987431d4fc4d38c18be7796161
SHA512 9fbd898f90dd22fc890e71e172c5f0249fa508482b1879cd849bbdf9a7f80e84a26d99e6f738fd666186030cb54fef22600cfeb70bb9dfb76b5b41228a7ee77f
SSDEEP 192:zRBgQdnv7PIa9VHcb+WNOi1qB/yIsn2Kgj:zRBg0Tbg2j
TLSH
T1CD02852EAD24A67FACC6E259F9253B42E7F5102135943D48D7FCCA2C28E7ACC1127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
Size 8KB
SHA256 32992d337d2f6818a45746f6059aecdf3492c684d147d95c724ca4d3ef8867be
MD5 ea59a557783c68ee58c7c04f5eeae9e4
SHA1 aac2b3ef7b0e8abf4631aaf8b8fd42f3a9f02dc7
SHA512 a884984b661bd74882d9826d32825d255881093c01ba7e707ec8d582b8f3e542bdab418c5847dfc45d402278aeaa52f7f356573672a50a3a1ce2b5ec32d7a49d
SSDEEP 192:zRBgQdnv7PVa9VHcb+WNOSXqB/yIsn2Kgj:zRBg0sbgcj
TLSH
T1EA12952EAD245A7FACC6E659F9257B42E3F5502134903D48E7FCCA2C28EBACC1127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Spotify\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 3KB
SHA256 b1e864670320522ad4e62b9d336e6d22696631dd037ca7d1f3e4d45d4b776d16
MD5 395553147ead0ba9e2da790d4d302caa
SHA1 0d55b625eaa22d108ee5cc0930655d4a453860e0
SHA512 fda7d38cdf2e83f1d8c84136cce999dbbd65e5fcd34a8d375418ba81e54d3bb63b0c58ddbc2d983f826b1dae996350022ef5ca1d0bee60e60b9b6eb2513450f0
TLSH
T13961D72964A9DD7768BBE441B4522F03EFA96027A2546FC8E1ED8B0C09F71EC0343513
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 6KB
SHA256 a39dfa51701724f6f896b3ad0f20010606d410e42ef637cb5f2e39e5a3fe0346
MD5 d60775b0678bd44f4014114c4d833ae8
SHA1 ca49116e6f25186def39b0e76207f40a0faec481
SHA512 72d03c38e6a11da6e8c7e8c4bd18eb73d3b2d420240114f3970e7bc1ab2decbc2959272367eab89dd66b9e4c79274fe0a491d6e8f32dd48cbd2387b13235262b
SSDEEP 96:ptbJ6yfAKnt+l/N+Dotoh+DotoyN5FgDQB6zTGyvVTGmHUF8Jzsvwea:TtkKt2cDUxDUB8UzWZXxsS
TLSH
T182D1C67DE587CEB7ECFB86813601F586EB44322591845AD498D58D0F46DB1EF320683E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a5b41.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe5a5b41.TMP
Size 1008B
SHA256 f517aa51209e280974b55a8e7819cf3c03b4626c6e78095d82c76f6dd6efe9f6
MD5 fd4a3cebc4197b0e0fe44f44e7d065c4
SHA1 c7b30d8a4ae7b175dc862410ad48a24e8e1a43ff
SHA512 e34cd45e7caba72157844952b20eb6a98daa31edc734c6b222b6a60050fec93bdb3b3f850273555c1cd8b36b066fdc1a7213bb7bc4d5845be116bea9ce913a05
TLSH
T18D1194737881AFB1BCA069B8A2569B830E1D803B815507CD73CA821617F346C014BC32
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Size 56B
SHA256 a85e84426662961c68bb3c7318a2d0c4ac370e8e533f09be0d3db3697d833119
MD5 12d9fcba58a0a09de30d71cc674153bc
SHA1 389306450bc5b49e5b3c466c211952f3241b56af
SHA512 df470ebd5a9fa6c42c97014979517e424ca54afa500663c983e76c062e788c5ec00b770b127c7eae45952bbfd6529eedba8d6e37f0d6f1c9b92da88eddc20f51
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
Size 236B
SHA256 cde146b003a21553d9d1b1d4843a175ee2b4043b601222cf80a5088e6506338f
MD5 4bf9e56b738c346510ff89f6c330dbf3
SHA1 685c7d0881852d5b9f7d5ca69661bec01e70f5c7
SHA512 118472d8ed5ede673c31c79b7b57cb4262a38885f64398d0820d69e6fb13d0a13574b5a4aca002dcfd8a0d84e4554cd47da2cdec5670b2f47fc5a99dff64bebf
TLSH
T1DFD0979C048DC0F80E0C023F41AE2C1BDCC32F005064387008832691392D30F2022827
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
Size 124B
SHA256 418e37a64c865013c87c6d30e5094d292fa74fb46e449d968ac83f492e46407b
MD5 65978328b8ddedd4a287abe5830f4bf7
SHA1 9bc9c6b04f3ec217420c3b4c0144f0cac646f106
SHA512 ccc0af038181bff44ec356fdc1a43a3a97fabf3aa55411bb08368ec95c3830229a7f5d7c23e85f55a3ddc7ad078de3ee2418fafa64d6dc92464892ccbab119bd
TLSH
T17CB09BCC05DD81B46E05867E517D1C57D6467F015464159555576511353834F0052157
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
Size 348B
SHA256 953c7ecef5b662a7a259d98ef9d6e200fd9e03c101cacea8c7f92b91a4cba7ef
MD5 cda3e0b1ba16f92ff766bb4175e21796
SHA1 1599af24d57aca09cf0d8da684fa0f433d45b746
SHA512 3d25e59a1c6ecab38a003b82d897d182afdfe8e6a02106fe5dad57f90484871352e0c382abd4549164fe34ecc94fe02db9a57db576030d857a676fe4fa20126e
TLSH
T127E0C0D9258E91E80F1D153F487E3D1FC4D22F04A1A4757458439781762930F207747B
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
Size 460B
SHA256 451ad62f270ef61f4c67fa59a3262df80a46233c026e14f64b46cbfbf763470a
MD5 8d9ead06ada855c43dd0c6d73d1c9bdc
SHA1 f354f767f6656656fe1c288797db1e3e903de5eb
SHA512 833829a167b111e1a8f8b42a9a96f3c505bb9d6b335f078d96546a3257fad1494eeecdcaeb788524568c3d37bb4b41d85f45f51a85904d25658248a5a1c366cc
TLSH
T162F0D4DA298E93E40F15142E0D69391ED5D62F04E1B574B84883D2512B3E31F207783F
MD5 SHA1 SHA512 TLSH

Submit Download

fbfa69c3-d16d-400e-bf53-40cafd0fd0e9.tmp

Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\fbfa69c3-d16d-400e-bf53-40cafd0fd0e9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

wrapped-2422942439.exe

Path C:\Users\Admin\AppData\Local\Temp\wrapped-2422942439.exe
Size 644KB
SHA256 81d7ad68abd04e611dab89b77bbe43e589367278e6765cae930ae19ae8468ee7
MD5 91ff7f5713c326426f5991ae1f231aa9
SHA1 5ba8c89104ee6ae9cec8148e1c13fe57803d8571
SHA512 22a8aba032e7d27bf40df9bb8743bc46bf816438834edfa5ef523bc1d71e0c8ec3ed60ddf84a9ff56ba8128b6940f29281f7693721a8c54e076aae305b3bf4db
SSDEEP 12288:fH6aNniIWkdwnAJ8zkivWnmjNF3oVNotBDM9:fdkkdwnlzkivwmjNBoP4BDM9
TLSH
T1CFE41A7EF791CCA8C28BC1F496878EA67930BD140231B35B12D522627F17CA05F9DB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrapped-2733673162.exe

Path C:\Users\Admin\AppData\Local\Temp\wrapped-2733673162.exe
Size 1.0MB
SHA256 f14487015a986e4a3af31222a2867ce181298419c67dcbfcfff6bbbfaa50232f
MD5 7a543618eff621e2310c380af085dfa6
SHA1 f81573d301a5914f8d4f64e25975d104d18d0f80
SHA512 44db6fb47c0e960b5499c2c4a1cdef6ebd90bcaa4f1e7629df3ce158c3fc4cf2004ccaa04b6f181c19d3e44a1e6b098787bb5754b805c512831597ef9e54ff9d
SSDEEP 12288:WaAmQBxXr/6jcRrz0u673pQqxZEZiLn5osowwB7DTSFi14jo:5vmXrJRrz03pQqxZEZD8o
TLSH
T10D354BC85B28D5AEE363D57D5021E27DEA317C220FC1860642E9A1FC1A7B774786BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
Size 3.8MB
SHA256 6578c6df6edaeccabc1ea69b7723e175bd3fb6b5d0453b933b45da52a92375cf
MD5 cf5e550fb70c5d25b1ee29e792df6c16
SHA1 1b3a332700c25e56b57cb96605d65ed83d9149a8
SHA512 837b9d86751279807d1cce2156f93abbecf42aaaf5e3c7387631088a9baa5e8c08bf737b0d35c31e38a92c54694fd65ff6f89f9bff82572407054e8ec3d35675
SSDEEP 98304:T60hGI3PkJP8IKq/An3MjoD1C+2YAqt5gZD5c/2T:T/93cJbK9LD4+2YAqTgZ1c/e
TLSH
T1BC16333082B45D5EC97E1B3081E046F9A3B90EB131B6EEBDE9E505F614272D38B74939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll
Size 4.5MB
SHA256 f8f699d0b9da81cc6547c5dc8038b58e2e7f483207a0478a81ca62b62040be81
MD5 aadc708f2d733f923d98674d86642157
SHA1 5111dba2be2b1e11ca1b873668f316bef6ba677d
SHA512 221f28973a5a89e4187fbddf6c65546e1b8eda17bfeb5aa3ff7193aaf25896d6f7868d487c1f9e42fb521df13465da12f1486838a5328a67f5f3f3b74c22afac
SSDEEP 49152:ASHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqS:LuktcrfNlTyj5byqSV
TLSH
T1E5268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.9MB
SHA256 0731eca3ec438395815907c04653c63a917b55bf0ebdd83c96f041424a92b54b
MD5 068a6a27d48940c0eaab6c1d45efc24d
SHA1 5daa0b9f34300d02d0f73c335fe3babf07bcb4ab
SHA512 458c78c1e25a31a4802fbbcb49a500b571b62d0645f71ac6ec6b541154b5f6797ea0834ac27c486d16eb7ae1fb2f49616ebb5560ce6f9ca43c19869997bbf030
SSDEEP 393216:YnHv+9DvVY+sp25wo/o/99SidlC8NtXHFeWn0Cl1NoeYl1N1:YGo25mZZx0e0d
TLSH
T1DE978DAB71E401ACC0AEE1BACB13DD27E7B7748A0731D34F01A092625F67A60567F752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 51712e30e17263764e2a4595164a19110174fd8edd4c8095d3b53946a123d695
MD5 7acdb3c90f94b89f8da6b4fc13f3ea58
SHA1 28c7f863bdc624294f291fc61bf5bce7c7270165
SHA512 6f7523bbea1fa39eb21199abf9e11340739575112d64430f80294aa834abe022dd8fd8dccf4e623cf708a4477303666d162eb4f71d7e109a12acd97172c9e82d
SSDEEP 49152:EHYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+di0:EHYg8xwfGrUA9Ncnas8jdF
TLSH
T1ABD57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Size 705KB
SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
MD5 0321d6c44a6041910208ce3891727842
SHA1 42e8935bd94f0fa3fd8611fc84e25a06e8ba82ed
SHA512 6c9348ed4d50fb2503012b80c0dc8f4cf07d00d2ff857fff8c102266533e65befc6535998f9497fe414cd427dfaf0ff3e5cd1b586addba236b3794768e3d476c
SSDEEP 12288:bI3H1fJwhjzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnSzm5dVYJblIt6kjKQCrC:U3VBE7zEEmPL8bTe+gnSzm5d2bc6kGQt
TLSH
T1FCE412E77374AC7DEE9B1277826505B0FC371A681B82020A179BF8796913B48D8C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Size 1.2MB
SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
MD5 d995543b367f8675ba74b90f42790175
SHA1 ae7f07096d74d1565929fffbf1a9711a08fc74e1
SHA512 99018c2cd0685bcfc6de8d08a649515b606982f56f1dced3b5304c7358e74bb463aa89795752580abff98b288865b49720940f8f0707a5f2527457edda968685
SSDEEP 24576:i3zB09p2zLmmibkFR8+mZi5r8BWhQumeMRvQt93dyQwuSXAkpbaUGQ74:i3y23mNbkFRJmQ58khQRT1QPtauSXAkA
TLSH
T19E4522D7A370DC7DDD530BB7929B40F4FD7A106B0AB2140A0627BD7A39257889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 bb15c2b2adf4703fb53f9efbf4977c2fdf6857c17946795928f3ea56629c3957
MD5 6e8eeb5e6498770a527446330396a293
SHA1 7137831701e82e67da48472971b354a3c11804a6
SHA512 b1b0039dc0141605336b953bff817e23e6be8b5bd8c01067ef3df390474d68bec20bee3077449aae86ef5896df333785b755af0d73c77fb6d99ccbd59b9fdded
SSDEEP 49152:ILOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l1s:IqG2qe6JBKDtXmKjs
TLSH
T1CDC56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 631B
SHA256 91f5ffbc16fb5fa7fa77a84ea5c8dc7d42e481e95a2b88f25b4531d38d8b9725
MD5 883d233976df2370a69e1c93147fd4bc
SHA1 6b704a3038fcb8fe9462ac185c9b2f0b5fe4d091
SHA512 238bb4de238d8718fdef827ef878e73415a4b95c4b6b2e03b70cf4256ecaf01d9d79502b98e51ac2b5e2f9a19971e632993c4aecab12feeb4acd7dcd78aef22a
TLSH
T13BF02DFF49D06579D0F10BA1D03C23147CB205951B2B805946531F993B48F6DDE5DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
Size 504KB
SHA256 84346bf58e8e1ab7d8c7cad803566476f9cee9880bc36737ac85e6eb07ff71bf
MD5 4fc9b1f27772eb537f93e4560d6165e3
SHA1 c85de4705db2698e26bcc0960106b87a3acdd2ed
SHA512 95ee83bb571687b89866ed8e64a4fa54862639d7ea1311bb07807633f1e4af57b770f46ca28461ae7598cfbe99a1d542035d5e3ea917ada1549171089478b866
SSDEEP 6144:OF1o4DAf5s1KStUkNbhk7Ak7KhPCcgoF0NKzdgbsQr7rVGCXoxL:u1o405CtUkBZk7K9CcgG0NWd/QDVGtL
TLSH
T1EEB48E15B2E94AACE07AC134CB438547EB7178460B61F6DF02E0A2792F77BE45B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll
Size 7.5MB
SHA256 1d14c828cb9dc37634168ee42cf38e0653760aa242c4e35aed291899d29e8421
MD5 ae1e38fc5745ca7795587d2e05605056
SHA1 704e8a7374b1214fc8ec0415177d597b96213be3
SHA512 966cd0d56d5cc8dee0a11e2a4811fc770b45f3e88ba001e5096bd3497be759581c2315de91005a097fbeac1e2346d2b5b693e374f86f4d14a4f59070e5180258
SSDEEP 49152:atvLjzlN4kFextqcusm4nHcpOjwrMQOT6n1SSCOQESgswJYgZc+5GTSpWy4EWT56:UWusNpjgKle2S+E8Nkpp0ve9fPzF1
TLSH
T10C867C13F69240DDC01DE2B8975B9223F778B8450764B2CF2A5453162FBAFE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Size 577KB
SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
MD5 2a1964ff31c7edff17f4c74d26fce378
SHA1 2c66f52ac23828ec6a18a6720ebfcb275482edcb
SHA512 fbb19f906ab8f61461c8be80d53a7cadddfe81524918171c0bfab45f9cec2f5c045ff7ff864858f5c087d4b05c585ba58dfdb7565302605efc524f388c241ba0
SSDEEP 6144:WpcHQYHQbmpKwey1WMmHfYOMg/jSxMP9sQqblfaYQhp1BPOjnng98//gwb:wwQKAGMDHfdgM6Qqbgaj+wb
TLSH
T117C42B1FF744122A05A352A27F099562FF32D06CA35112663CBD812C3376B6693BB7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Size 16KB
SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
MD5 8ce43bf0bee69290545738ae472bd5dd
SHA1 bbc36343250fa8bb2122c8af9e021fc80c032a0b
SHA512 67825fdb6c0381b7e35c73221caf37374157c1333388d0d20685f4d732340f7fc04faba29ae266fcaa921fff2694b5f8ca0ba24fbbdce2146189924e354df7a5
SSDEEP 384:5rg5RkIUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/neqA9oz+EFRUeLq4+lLbK74Tdu/:kgOXqEXqP
TLSH
T1DC72B89F1B21CA38E637477F6A5E3125EB3B805C4F91953419BBA44823C639603F71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-Hant.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
Size 16KB
SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
MD5 d41d181d619aef4a1af14bcd6ad2fc1c
SHA1 05ea268a59c887a92387a2ad2925285901bba1ba
SHA512 b2ed7c0c97672411266ef55cfed4e98a7d812e85a20706140c8ea8c566677ed9bdcfaac7d0656496e34db5a7a50e0c9e810fe9a18c2039630745ce617513b605
SSDEEP 384:pFTaUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/na5k+0SyIqLvsZXPuD:LxOXq+LBDXPuD
TLSH
T15E72175B1932CE38D5378B7E5B9F3624E63B612C5ED164342BEFB41423C636A16E2053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs

Path C:\Users\Admin\AppData\Roaming\Spotify\prefs
Size 153B
SHA256 aecf82f3a7221851d34e2ebb30eb524c25f54739dbf97c11d9ff19340ff9f02b
MD5 c9980db8157b3e986df470a673f0e96c
SHA1 d3ba2d43566f391fead4fe401e78976a9ca1000d
SHA512 88c71347b33ae62d6758bc6f1dd29f3cb68f1602f6c60a8ded658e6488ff40f571e02279937066159b9d0d068cf308622705f41dceb2ee791993bf47eb7aff57
TLSH
T124C08C8DA40BEF708C90094EE21176088070708EB8CE52194E2301084C8E71C2A213A6
MD5 SHA1 SHA512 TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Size 17.8MB
SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
MD5 c6c9a3d440e436b8c28867f3c3955ce9
SHA1 208847cb98181e6ba434dd5ec17d686824604946
SHA512 2e1d53d773f57cf8c311674d60615602670d44af7a7545c60172ebbd47d6bb32e382c4cc91a5394fc1a51dab4b654be822f81f1ea963ec1176624b0bea6a6f1a
SSDEEP 393216:pqX9UazcYdpnzyXm++SSSCZMwh56qAgbITfTK3l76TmkrqjFWBm0iw+X:pqtJzcYnzoN+wCW4AAITG3lVkMgmeI
TLSH
T10A17124BA758562BCE3F07B74652563F373091197F835307209283281C6A7FBAD8DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Size 16.5MB
SHA256 aa24dd3365f6286af18dd73e66a368b3b62ba42fdf1853c9c30bb1dc17488a73
MD5 0eeb87ebdd102894bf9c221af4dba99f
SHA1 23cb3f9710b1e0b335ce9195dd11f3b061db70c9
SHA512 5dd083248fc5627027ad715e32a29673b849fc8121ba50518d489d6cc15ef3d39b0084b1cb9f176058e136f3ff6ac7e3fa663e772f15de0e9bad3250740b7d5e
SSDEEP 49152:nXKLhqZSjKuoNrcUgQzBiogH5BroyMqYS7gn/MlClJTiG315:mUbz315
TLSH
T1B0074780E7F95348F2F77F65EEBA90564836BE96ED29C75E0414050E0831A4C99BAF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Size 5.2MB
SHA256 50f422c53e00c586e163424e5f08c765094b39fe855e4fb73c1e587b3fe37e9a
MD5 b51488e17c6f40a8737eef419db93c75
SHA1 94a2b72d745c2697ad986747b8046e7c2d3323f0
SHA512 06fb4de31214f538b0e6d9c834d49c59b5fc88f943db9ee547b04c65c746fecf811177198aefc3d126f3611cc28e9190c48c8558ec63a68f9f8d4ae423b3a4b6
SSDEEP 98304:f4ydZOjlb3GaE1COMOIFGOOOOOOOOOOOOqLOOOOOOOOOO3:IlC09GOOOOOOOOOOOOqLOOOOOOOOOO3
TLSH
T1A3463803F19680E9C06DD579875EA623B632F8840B3676DF66A00F1A2E79FE0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-899-0x000002DC46ED0000-0x000002DC46EFF000-memory.dmp

Download

memory/124-900-0x000002DC476C0000-0x000002DC47793000-memory.dmp

Download

memory/1444-828-0x0000023B23A10000-0x0000023B23AE3000-memory.dmp

Download

memory/1444-827-0x0000023B232E0000-0x0000023B2330F000-memory.dmp

Download

memory/2260-780-0x0000025C6E580000-0x0000025C6E5AF000-memory.dmp

Download

memory/2260-781-0x0000025C6E6C0000-0x0000025C6E793000-memory.dmp

Download

memory/2780-349-0x00007FFB471D0000-0x00007FFB49AE7000-memory.dmp

Download

memory/2780-696-0x00007FFB471D0000-0x00007FFB49AE7000-memory.dmp

Download

memory/2780-692-0x00007FFB471D0000-0x00007FFB49AE7000-memory.dmp

Download

memory/2780-350-0x00007FFB471D0000-0x00007FFB49AE7000-memory.dmp

Download

memory/3552-652-0x00000264E0180000-0x00000264E0253000-memory.dmp

Download

memory/3552-651-0x00000264DF9B0000-0x00000264DF9DF000-memory.dmp

Download

memory/4200-412-0x00007FFB6C040000-0x00007FFB6C041000-memory.dmp

Download

memory/4200-647-0x0000020246690000-0x0000020246763000-memory.dmp

Download

memory/4200-646-0x0000020246550000-0x000002024657F000-memory.dmp

Download

memory/4200-411-0x00007FFB6BFD0000-0x00007FFB6BFD1000-memory.dmp

Download

memory/5008-930-0x000002B9A6EE0000-0x000002B9A6F0F000-memory.dmp

Download

memory/5008-931-0x000002B9A7580000-0x000002B9A7653000-memory.dmp

Download

memory/5076-13-0x00007FF686F30000-0x00007FF686FBE000-memory.dmp

Download

memory/5824-943-0x0000015E75880000-0x0000015E758AF000-memory.dmp

Download

memory/5824-944-0x0000015E75F70000-0x0000015E76043000-memory.dmp

Download