Analysis
- user interaction
yes - max time kernel
140s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 23:48
Behavioral task
behavioral1
Sample
spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe
- Size 11.3MB
- Sample261007-3tk54sht9m
- SHA256 859be093b02446ecdfc6c4c745eed153efd8fb52ead6663e8c6d1943b772effb
- MD5 fc05bbab4ca70646a4714c6076d1aa78
- SHA1 4dc44b7345ee9b6b0996b2967176764709e0feca
- SHA512 a2c4af6b37d76f16126a5e433491215fcfeb2b4a022704e10c754432f6159653b7ebed38d79f3520b6dd3c7dbab289f879a303f036b40fb6e16a235a2992a677
- SSDEEP 196608:Mbibe3n9C3zb3NoMIPu+6LadJIhD5EybWcLs1leyrENBrpjTWYrs31uLHZ:Mbicn9C1oM1haXIhDaSee5Vpjnp
- TLSH T198C6233FB28B713EE06E5A353A76D220953F6A51A5528C069BF4C85CCF250B01E3F6D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
pid Process 1852 spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp 2612 spotifast.exe 1828 spotifast.exe 5292 spotifast.exe 2160 spotifast.exe 5148 spotifast.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/4368-0-0x0000000000F70000-0x0000000001054000-memory.dmp innosetup behavioral2/memory/4368-8-0x0000000000F70000-0x0000000001054000-memory.dmp innosetup behavioral2/memory/4368-56-0x0000000000F70000-0x0000000001054000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Modifies registry class 18 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\spotify\DefaultIcon spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Spotifast\\spotifast.exe\",0" spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\spotify\shell spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\spotify\shell\open spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Spotifast\\spotifast.exe\" \"%1\"" spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Spotifast.spotify\shell\open spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Spotifast.spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Spotifast\\spotifast.exe\" \"%1\"" spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\spotify\ = "URL:Spotify link" spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Spotifast.spotify spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Spotifast.spotify\ = "URL:Spotify link" spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Spotifast.spotify\URL Protocol spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Spotifast.spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Spotifast\\spotifast.exe\",0" spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\spotify\shell\open\command spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\spotify spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\spotify\URL Protocol spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Spotifast.spotify\DefaultIcon spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Spotifast.spotify\shell\open\command spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp Key created \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Spotifast.spotify\shell spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1852 spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp 1852 spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5112 taskmgr.exe Token: SeSystemProfilePrivilege 5112 taskmgr.exe Token: SeCreateGlobalPrivilege 5112 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1852 spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp 2612 spotifast.exe 2612 spotifast.exe 2612 spotifast.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 1828 spotifast.exe 1828 spotifast.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5292 spotifast.exe 5292 spotifast.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 2160 spotifast.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2612 spotifast.exe 2612 spotifast.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 1828 spotifast.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5292 spotifast.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 5112 taskmgr.exe 2160 spotifast.exe 2160 spotifast.exe 5112 taskmgr.exe 5148 spotifast.exe 5112 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5112 taskmgr.exe 5112 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4368 wrote to memory of 1852 4368 spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe 89 PID 1852 wrote to memory of 2612 1852 spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe"C:\Users\Admin\AppData\Local\Temp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\is-TTS9XHZEUW.tmp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-TTS9XHZEUW.tmp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp" /SL5="$70232,10599627,872960,C:\Users\Admin\AppData\Local\Temp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2612
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3976
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1288
-
C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1828
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2880
-
C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5292
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast-installer.txt1⤵PID:628
-
C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2160
-
C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe"1⤵
- Executes dropped EXE
- Suspicious use of SendNotifyMessage
PID:5148
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast-installer.txt
- Size 24B
- SHA256 c0e5f2bc27043a3bd90d837702f16d64ea17656391c3e358cf4eb5b28dfc7187
- MD5 fe6b019c4cffddbf5011320a1c7f532f
- SHA1 509546529de80f5275ed6a8821f91c2a8257a313
- SHA512 ab848a739bd22d351c07b74a19c861b081bc4b469ab4a35ec376c04cc4521a00c037d9a6d25c4a8dc664b514e068113be2450c4b6b5b3e8f9c9a27c5f384e5d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Programs\Spotifast\spotifast.exe
- Size 29.0MB
- SHA256 e4867b8eb54021732126b6f0c906702b31d2ffc7a6e725e3dcb121b2f478fe01
- MD5 8e8d158cf0d5bc176e497bcbeeed8ee4
- SHA1 4700f2325e9eaf7d011e268a80f8f75c1b39c73e
- SHA512 d4b724c30416dbc0f7fca252e4909d13c7be0c84cbe27846436de2561ec471e6bcdb73ac8b97bb0e54e98782eda6af4c721f22cecbd14b892dd69410766a5f7a
- SSDEEP 393216:KOSWRmRy/HCvVcZ45viVxwq7ite7RAf7mGUpq7MLgpte+ptbljuOO3:KOngdpt7ptblCOe
- TLSH T193677B43F2A290E9D02AC074935AA633FB71784A473576EB5BD04B313FA5BD06A3DB05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-TTS9XHZEUW.tmp\spotifast-v0.12.0-x86_64-pc-windows-msvc-setup.tmp
- Size 4.2MB
- SHA256 e29432eded5dd93124630e0924d89198191bd6a42304aa77add667c17b1780ff
- MD5 c5b2388138a09a1b29367fcdd0256186
- SHA1 65c50b09723f0b3a83b283fa4f975ba3eada4a2d
- SHA512 3c10e932b990f9f9a11c2edf6910ed7a9089905b2ac8f2281ba31e194e2036fb2208ea1e5c8330249ec09f21ae59550e65c9c5bc34aba9a0a3c6d583d6a344a8
- SSDEEP 98304:nYU5hnuOajWwMPdCpepI3GrwrA+Jv333V:RxuHjWfZIzh
- TLSH T1A9168F03B388753EE4571A3A583FA284983F7A213A26CD4F6BF40D5C8F396416D2A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\paolino\spotifast\data\spotifast.log
- Size 481B
- SHA256 d7e7e065af051cbe7943b706099c1a2c13810dd6c8180f05edcd542971e694c0
- MD5 f6a4b726117116e6ee6249e3f7cdff09
- SHA1 038d913dd4e15fc70df5c43065428870633e29b1
- SHA512 2316483bd5d072999b93e9c5e1a73148151b830873b346e8eedf87f366b9cb29f0ddc7b083a0447c82347f14ae02da9be985d03b7e2b2a92f8da0db15373a494
- TLSH T1A0F09E404257413274B346C47E1FE935C763C0B8D3500566524C4758B0A9D75AEFA16A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\paolino\spotifast\data\spotifast.log
- Size 481B
- SHA256 ce28f6711ba6a042c1bf85a8ae4cdb1b1210144e826b6f19dd846f18ad48abe9
- MD5 0d7ae0400f824af8a0235271086d5fcf
- SHA1 974f1c36e944b7ba2864300ed72e673bcc9d9a49
- SHA512 8ab8cb308236303a425f5c0e2a33830c17a1805f7e56d911bd10e074678b27abaf44bd95d140b037fd9364a4349b08c5adad5ad3decd8b2ba4d6c9746742ee41
- TLSH T188F09740836B8131B4B386C87E2FF52DCB63C0B8E150446A524C8668B098E75BEBB261
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\paolino\spotifast\data\spotifast.log
- Size 481B
- SHA256 da8c363b45b050ec5b69b99314d6ac87b500fc5ef6dc453cd0cb30f07d7bdf33
- MD5 463190de1574df73135d52966e565465
- SHA1 caf3719f34432cd0de5d27aac74479a31c4e20b6
- SHA512 aacc8561fd8cf85cb8f0c7b6751add78a1cff410867d9e392c0b61e308a70edb9b426a84373d41c85037853b5ab0b9e2ed8b47beeb7d4cb8c9f9c41f7a599e3a
- TLSH T1EDF09E044377417174B346C47E1FF52CC763D0B8D0510455524C4664B088D75BEBE161
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\paolino\spotifast\data\spotifast.log
- Size 481B
- SHA256 95e7e43b4ca84e9a2d1b77078bf3ac9514f1b46f3ac82a984cc2b6e2db0ef484
- MD5 ac14d6670f17ab97a7648f9a46233ab9
- SHA1 2b703585fd139e6651620835abaf76d49b944bb1
- SHA512 f6fe59f4b1d91ace5200cc41b2dc2305b4b753b6384a088483c355a29387f9929412a424bb57b17a188e33e52c3a02b56375c02cf632e5cd6f94bc1a8619ce17
- TLSH T11EF02E508257527174B346C57F1FE52CC763C0BCD0514455524C465CF498D75AEBA165
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotifast.lnk
- Size 1KB
- SHA256 996b095c369d4b9449f43f2a69f346c9408e179046a60d8e97b6b77f2c05ee91
- MD5 57d3b8f2ecbf87b9ab796d7c20cf66d6
- SHA1 8d8ffbca7ea3ad7d362d2750c9489127ad266012
- SHA512 c0323eeb49f78d63c30f69369117a551d1efc5821bd50410af6fe77e4f16b536f1b6e037a49cb8bfd4aa4f2b722e40baa8b97f2849565e6ecf7f7dff2da90d3d
- TLSH T13F21D0125CA92B25DFF68636119BB634D13FA852DB418E191385528A3C39A11FE64F0F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\.installed-palettes
- Size 135B
- SHA256 648201537a89265f0a719f48ffa913ba952d8f23cba4b0ba2bc46e16cbb598f0
- MD5 4466624aa666703fd66563e265936655
- SHA1 dd81561e6d143a4aba503cfae697864619e36a16
- SHA512 cb72f7b370d104e2d6ab067236b8a4fec46dfaa70e2ccb83fddabb86bebf10b7dcbfaa391bd11851d515c9df23e6ec403788b37e2fca5bfb5c3286f7fe0a1732
- TLSH T19DC092FD0890DF0C98CD009E8A806218CBE42F6BC0E07B23647289B3162331CB2336B3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Catppuccin Latte.json
- Size 414B
- SHA256 b99bef4c810b4909f68428f8cc3ddde03dea80ac8dd8ad1a66f743529212e86e
- MD5 7447cdbfcec73b8ce5d53733a740033e
- SHA1 e91fb97eb4735c83f8fb8d7539f129f055336c91
- SHA512 b1a539586059c195b14488c60b8187515663b969de510188897e46f373deda6cbba0c0ad092f85874fa3d3161db98705b9877d9a31aed9751ab2a7e2264be3b4
- TLSH T19EE09274EE10BEA3A66992870D3A7283D18091278D4C7D1E330492CC0FCF68F1632D6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Catppuccin.json
- Size 413B
- SHA256 f88a3b20f470a129001f34b5f3fdec1d7823de5ab75b9ca1503ce72643789d3d
- MD5 e1112856df26baf3fa61223f024f93f2
- SHA1 e5fb10b845fc8087cfd5ba84b83e938c0f455daf
- SHA512 619e50119ad38b82219b66371931d0111ec811718bb7ae4145f3a7044f464a16974886aa86e326832b9d8c43cca75e9cd9f2cc22fd8a648d8f4bd4663751885e
- TLSH T189E0D838EE107D639969A28719250E4385C0D6134D0C399673B892DD0F9DACF5535D6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Nord.json
- Size 413B
- SHA256 d4e2e8fce15442dd1533e7c5c0c47f7a363ec0d15d201b0bc127b4aef6bcbfeb
- MD5 c843a2a4b339f11892f340ed652b7497
- SHA1 ea407ba3fef59160fa5a987486aa36d2cbf1ee60
- SHA512 8db68bfdf6befe0968fa8f7fc85fcbfd996bf291848cea27b1c450b8873ccebdead7f8323675523921a12ea42d5006e1f57e69304f3a3114db6437f0ff13e24d
- TLSH T1ABE02239EE603D23466452562C3A06479184F0871C0CB89A3328D6CC0FCEACF4331D2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Ristretto.json
- Size 413B
- SHA256 54a54190d0fe09cae6946a31efaa8a630993d747a5741ab6fdaccfcc85cf911c
- MD5 cc3a1ae889c3e8d5a87473de6d65c01e
- SHA1 9e33e8382a9523aa2c3c01c8de5913ca59742965
- SHA512 0e0915a3cb3624c6aecb1a721638366ed3762331203f94beda742beb57615443df206fa7bb186f09c07bc24e96a83bf7d3cce6027ba52bae9efd152c31ec8a01
- TLSH T193E0D834EE107D638128538B1D2E16878180A1432D0D7D55732852CC8F8DEDF8635D6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Rose Pine Dawn.json
- Size 414B
- SHA256 6fa67ef765db32ca7617004fbb82d3a72954fc765275025d35948d55da866f43
- MD5 3f508a5574bb1741b641daefca7f64ba
- SHA1 1bf36efcaf5ea264b6347650e0534bed80610a9c
- SHA512 07269c4221865942ccc0591a1693998447ddea604012a8e7f00acf9fce10f63cfa94f05c251af7c7ef9c78a4ed22b7c8972969eb614a85903b11c97dff15a3b3
- TLSH T16CE09234DE10FD978AA0551B4C2B22579180A1571D5E7C66732492DC0FCDBDF053286D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Rose Pine Moon.json
- Size 413B
- SHA256 1023af76a3fc3e69a3b011ec249b31ff512f23cd4376b6a61337b049cd794913
- MD5 406b4e604357a8ec32dad9aaf72b0599
- SHA1 5326349a7d7d8fc547774d8510b59a299a7031e4
- SHA512 97142bd8b23bcee323823ff75167383a3749d9c7998547b62fba17bd5f6f4f013e5b9a88fba0a3a1e69ff6d4eaa3f2acfe2fa0232b4e0ca45c151376dbe077b6
- TLSH T149E06D34EF107D5389A85286592A068791C0F2434D0C399A333861CD0F8E6DF4975D6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Rose Pine.json
- Size 413B
- SHA256 22a4ec4f1e0bd4acf252e21de2811f554e20ad02c1bc19fa4308bde59a0dc70e
- MD5 446ce672d2fb232ac9a8075c69a927cf
- SHA1 379a503d956ca9129a84827b39744d6947e20dd6
- SHA512 86b91b67b0c5294f7a35a4ce9593db822f18d4d22b10d8e2a192e3fdec22aaaca88b1b95791a2d40c8e898eb9fedb6214295e956e8ab91077abb1521eb2ecedf
- TLSH T1B0E0D834FF547E638A796646182A0983D280D6534C0C39DA332862CC1F8EADF4A3A87D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\paolino\spotifast\config\themes\Tokyo Night.json
- Size 413B
- SHA256 ac7f407a78c1b647d5515fa15d8d1a6670021b3eae48777122b2df2257b27f4c
- MD5 0318fd4f49d51ce3c60ecf60dd017ad4
- SHA1 57da5b5e5a9d5f31ab85c881ed65a6cf1f40f943
- SHA512 94b9ffcf94fab19f3e0dba376a5051038373115999f8e409b31d2fd97d36ccf35002ceb44268ef46f678a3a0ec039367c54620e63c179323b05326ad000c6b61
- TLSH T115E09239EF117E638559668A492A0643D284F2531C0C38193354A2DC0F9DACF4575D6E
- MD5 SHA1 SHA512 TLSH