47dd3b96d620554569a957c1571b202f224a6ba2432cee71530613e1743fc0ac

Analysis

max time kernel
89s
max time network
122s
platform
windows10-1703_x64
resource
win10-20220812-es
resource tags

arch:x64arch:x86image:win10-20220812-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
04/01/2023, 13:57 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpotX-Win-main/Install.bat
Size

332B
MD5

dff84ca99df0b5e3dd96966d340b1821
SHA1

e70941bd9de9d95b4f6dc951ab6e87d5e87e9eab
SHA256

d93d5704ae00dff90158c387377933da0492736172a2104755dde20cd940cab1
SHA512

6f60e76701f3d3461f2d400037e5cf44ac29448d6009036419b4dc4cfe0e3617ec5d2728d4dd1371bd86a442eecdf9c5a4b85a12fa39082a75d4d5880eb7b98a

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	4360	powershell.exe
4	4360	powershell.exe
6	4360	powershell.exe
8	4360	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1824	Spotify.exe
4204	Spotify.exe
4296	Spotify.exe

Loads dropped DLL 2 IoCs

pid	Process
4204	Spotify.exe
4204	Spotify.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4360	4148	cmd.exe	67
PID 4148 wrote to memory of 4360	4148	cmd.exe	67
PID 4360 wrote to memory of 4076	4360	powershell.exe	70
PID 4360 wrote to memory of 4076	4360	powershell.exe	70
PID 2600 wrote to memory of 2096	2600	explorer.exe	72
PID 2600 wrote to memory of 2096	2600	explorer.exe	72
PID 2600 wrote to memory of 2096	2600	explorer.exe	72
PID 2096 wrote to memory of 1824	2096	SpotifySetup.exe	74
PID 2096 wrote to memory of 1824	2096	SpotifySetup.exe	74
PID 2096 wrote to memory of 1824	2096	SpotifySetup.exe	74
PID 2160 wrote to memory of 4124	2160	WScript.exe	79
PID 2160 wrote to memory of 4124	2160	WScript.exe	79
PID 4124 wrote to memory of 4204	4124	cmd.exe	81
PID 4124 wrote to memory of 4204	4124	cmd.exe	81
PID 4124 wrote to memory of 4204	4124	cmd.exe	81
PID 4204 wrote to memory of 4296	4204	Spotify.exe	85
PID 4204 wrote to memory of 4296	4204	Spotify.exe	85
PID 4204 wrote to memory of 4296	4204	Spotify.exe	85
PID 4372 wrote to memory of 5060	4372	WScript.exe	84
PID 4372 wrote to memory of 5060	4372	WScript.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpotX-Win-main\Install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& {[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12}"; "& {(Invoke-WebRequest -UseBasicParsing 'https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/Install.ps1').Content | Invoke-Expression}"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-01-04_14-59-04\SpotifySetup.exe
    3⤵
    PID:4076

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-01-04_14-59-04\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-01-04_14-59-04\SpotifySetup.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    PID:1824

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Spotify\cache\hide_window.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Spotify\cache\run_ps.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.2.582 --initial-client-data=0x3fc,0x404,0x408,0x3d8,0x40c,0x6994ed00,0x6994ed10,0x6994ed1c
      4⤵
      Executes dropped EXE
      PID:4296
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1640 --field-trial-handle=1748,i,16288243252667872458,13688416925826634103,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2440 --field-trial-handle=1748,i,16288243252667872458,13688416925826634103,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      PID:4888
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --lang=es --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=2476 --field-trial-handle=1748,i,16288243252667872458,13688416925826634103,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/106.0.5249.119 Spotify/1.2.2.582" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --first-renderer-process --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=3292 --field-trial-handle=1748,i,16288243252667872458,13688416925826634103,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
      4⤵
      PID:1616

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Spotify\cache\hide_window.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Spotify\cache\run_ps.bat" "
  2⤵
  PID:5060
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
    3⤵
    PID:4712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -nologo -noninteractive -command "& '.\cache_spotify.ps1'"
    3⤵
    PID:2252

Network

DNS

raw.githubusercontent.com

powershell.exe

Remote address:

8.8.8.8:53

Request

raw.githubusercontent.com

IN A

Response

raw.githubusercontent.com

IN A

185.199.108.133

raw.githubusercontent.com

IN A

185.199.109.133

raw.githubusercontent.com

IN A

185.199.110.133

raw.githubusercontent.com

IN A

185.199.111.133
GET

https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/Install.ps1

powershell.exe

Remote address:

185.199.108.133:443

Request

GET /SpotX-CLI/SpotX-Win/main/Install.ps1 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; es-ES) WindowsPowerShell/5.1.15063.0
Host: raw.githubusercontent.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 60955
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "b1c5e7a0c6cedfe67126734c3a7c68a4a78d1c042850d0a76222296c58f166d4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: DE60:7BD8:17CCFB:1B5D86:63B57D44
Accept-Ranges: bytes
Date: Wed, 04 Jan 2023 13:59:03 GMT
Via: 1.1 varnish
X-Served-By: cache-ams21022-AMS
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1672840744.722252,VS0,VE227
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: d4c6826775dab9b041d083ac73ae189a8372890f
Expires: Wed, 04 Jan 2023 14:04:03 GMT
Source-Age: 0
GET

https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/scripts/installer-lang/es.ps1

powershell.exe

Remote address:

185.199.108.133:443

Request

GET /SpotX-CLI/SpotX-Win/main/scripts/installer-lang/es.ps1 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; es-ES) WindowsPowerShell/5.1.15063.0
Host: raw.githubusercontent.com

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 4472
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "2a80270cd70eaf71538e0cf14300f489ba1305a09542f51006675b2a38dd2037"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 6C7C:7BD9:374A81:3BBD30:63B58628
Accept-Ranges: bytes
Date: Wed, 04 Jan 2023 13:59:04 GMT
Via: 1.1 varnish
X-Served-By: cache-ams21022-AMS
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1672840744.400957,VS0,VE177
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 098a0b033b8302c283ea9d456f1718b8d22c7423
Expires: Wed, 04 Jan 2023 14:04:04 GMT
Source-Age: 0
GET

https://raw.githubusercontent.com/amd64fox/SpotX/main/.github/cutt/test-cutt.txt

powershell.exe

Remote address:

185.199.108.133:443

Request

GET /amd64fox/SpotX/main/.github/cutt/test-cutt.txt HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; es-ES) WindowsPowerShell/5.1.15063.0
Host: raw.githubusercontent.com

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 4
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "456973c64c43555f112156339523fc63ee7bc5d317ec227f3ebf785ae3bedfe7"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 4C24:88F9:24B337:2830AE:63B54C05
Accept-Ranges: bytes
Date: Wed, 04 Jan 2023 13:59:04 GMT
Via: 1.1 varnish
X-Served-By: cache-ams21022-AMS
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1672840745.932894,VS0,VE40
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 5d382407ee2e24ec29b2583a04dd9a1946cc26e2
Expires: Wed, 04 Jan 2023 14:04:04 GMT
Source-Age: 0
GET

https://raw.githubusercontent.com/SpotX-CLI/SpotX-commons/main/patches.json

powershell.exe

Remote address:

185.199.108.133:443

Request

GET /SpotX-CLI/SpotX-commons/main/patches.json HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; es-ES) WindowsPowerShell/5.1.15063.0
Host: raw.githubusercontent.com

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 30543
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "25e124b203655fc85bf686268dff969aeb08f788a8915d72e73be8830aeb6c5c"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 7668:D88E:B9ECF:DB145:63B50C69
Accept-Ranges: bytes
Date: Wed, 04 Jan 2023 13:59:59 GMT
Via: 1.1 varnish
X-Served-By: cache-ams21022-AMS
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1672840800.766162,VS0,VE1
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: cbb7a2db2b67319c3c7e8518c0cde5d698b99356
Expires: Wed, 04 Jan 2023 14:04:59 GMT
Source-Age: 25
GET

https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/scripts/cache/cache_spotify.ps1

powershell.exe

Remote address:

185.199.108.133:443

Request

GET /SpotX-CLI/SpotX-Win/main/scripts/cache/cache_spotify.ps1 HTTP/1.1
Host: raw.githubusercontent.com

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 1856
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "49201ffe7577a1ebb5e44e46211d18fe718160c2eeb9d03a3a3f40c494913fa4"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 4756:7B8A:359824:39EA9D:63B57DC2
Accept-Ranges: bytes
Date: Wed, 04 Jan 2023 14:00:13 GMT
Via: 1.1 varnish
X-Served-By: cache-ams21022-AMS
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1672840813.236452,VS0,VE175
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 9fa23922fa5b26eb53f4990b5eac57d5b53f26d6
Expires: Wed, 04 Jan 2023 14:05:13 GMT
Source-Age: 0
GET

https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/scripts/cache/hide_window.vbs

powershell.exe

Remote address:

185.199.108.133:443

Request

GET /SpotX-CLI/SpotX-Win/main/scripts/cache/hide_window.vbs HTTP/1.1
Host: raw.githubusercontent.com

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 140
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "164c2cc276a9bd1e19b2f3ecbb41e106372b1fd287b08e7aae206b1196c59ce7"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: B08A:3BC0:320FAD:3653A8:63B57DC2
Accept-Ranges: bytes
Date: Wed, 04 Jan 2023 14:00:14 GMT
Via: 1.1 varnish
X-Served-By: cache-ams21022-AMS
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1672840813.446299,VS0,VE768
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 16f9a82eb275e61c2b14ddf66a6d4a1cb81bcd0d
Expires: Wed, 04 Jan 2023 14:05:14 GMT
Source-Age: 0
GET

https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/scripts/cache/run_ps.bat

powershell.exe

Remote address:

185.199.108.133:443

Request

GET /SpotX-CLI/SpotX-Win/main/scripts/cache/run_ps.bat HTTP/1.1
Host: raw.githubusercontent.com

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 154
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: text/plain; charset=utf-8
ETag: "68af26bdee40baf273a661a65288e62915bc7794f2ea5e942a99212e3f18c857"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 7FFA:88F9:3398CA:37E0D7:63B57DC2
Accept-Ranges: bytes
Date: Wed, 04 Jan 2023 14:00:14 GMT
Via: 1.1 varnish
X-Served-By: cache-ams21022-AMS
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1672840814.249797,VS0,VE128
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 424815a2f7c15aa4389ac255f67cb337c5652f0d
Expires: Wed, 04 Jan 2023 14:05:14 GMT
Source-Age: 0
DNS

cutt.ly

powershell.exe

Remote address:

8.8.8.8:53

Request

cutt.ly

IN A

Response

cutt.ly

IN A

172.67.8.238

cutt.ly

IN A

104.22.0.232

cutt.ly

IN A

104.22.1.232
GET

https://cutt.ly/DK8UQub

powershell.exe

Remote address:

172.67.8.238:443

Request

GET /DK8UQub HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; es-ES) WindowsPowerShell/5.1.15063.0
Host: cutt.ly
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Wed, 04 Jan 2023 13:59:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
set-cookie: PHPSESSID=0g55j4sld03g6i1e5b6lht72ro; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
pragma: no-cache
location: https://raw.githubusercontent.com/amd64fox/SpotX/main/.github/cutt/test-cutt.txt
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 78447e1f08bc0a63-AMS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
DNS

docs.google.com

powershell.exe

Remote address:

8.8.8.8:53

Request

docs.google.com

IN A

Response

docs.google.com

IN A

142.250.179.206
GET

https://docs.google.com/spreadsheets/d/e/2PACX-1vSFN2hWu4UO-ZWyVe8wlP9c0JsrduA49xBnRmSLOt8SWaOfIpCwjDLKXMTWJQ5aKj3WakQv6-Hnv9rz/pub?gid=0&single=true&output=tsv

powershell.exe

Remote address:

142.250.179.206:443

Request

GET /spreadsheets/d/e/2PACX-1vSFN2hWu4UO-ZWyVe8wlP9c0JsrduA49xBnRmSLOt8SWaOfIpCwjDLKXMTWJQ5aKj3WakQv6-Hnv9rz/pub?gid=0&single=true&output=tsv HTTP/1.1
Host: docs.google.com
Connection: Keep-Alive

Response

HTTP/1.1 307 Temporary Redirect

Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Wed, 04 Jan 2023 13:59:06 GMT
Location: https://doc-0k-as-sheets.googleusercontent.com/pub/8hg3b1ek8ops3o87ml9dh1hpus/tajt9egdv69ah7cem92d41m9o8/1672840745000/106179285666896972671/*/e@2PACX-1vSFN2hWu4UO-ZWyVe8wlP9c0JsrduA49xBnRmSLOt8SWaOfIpCwjDLKXMTWJQ5aKj3WakQv6-Hnv9rz?gid=0&single=true&output=tsv
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Set-Cookie: NID=511=SrITPd0ULpcFeS9HpI8atiXkwhiLjPxutlhN2tRY6f7FuBhB1VT5RAgPKGd1Yb-nxbBA4OTjupxMRMpT_LeOBLQ3zi12uobar_J-mbo7mnW_ScY1QZ5gWF62Y8Mz1VfRQOGpB41lNxz9QCoNpsObfQjv2qnLUjn8QDpm93OsJYQ; expires=Thu, 06-Jul-2023 13:59:06 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
DNS

doc-0k-as-sheets.googleusercontent.com

powershell.exe

Remote address:

8.8.8.8:53

Request

doc-0k-as-sheets.googleusercontent.com

IN A

Response

doc-0k-as-sheets.googleusercontent.com

IN CNAME

googlehosted.l.googleusercontent.com

googlehosted.l.googleusercontent.com

IN A

142.251.39.97
GET

https://doc-0k-as-sheets.googleusercontent.com/pub/8hg3b1ek8ops3o87ml9dh1hpus/tajt9egdv69ah7cem92d41m9o8/1672840745000/106179285666896972671/*/e@2PACX-1vSFN2hWu4UO-ZWyVe8wlP9c0JsrduA49xBnRmSLOt8SWaOfIpCwjDLKXMTWJQ5aKj3WakQv6-Hnv9rz?gid=0&single=true&output=tsv

powershell.exe

Remote address:

142.251.39.97:443

Request

GET /pub/8hg3b1ek8ops3o87ml9dh1hpus/tajt9egdv69ah7cem92d41m9o8/1672840745000/106179285666896972671/*/e@2PACX-1vSFN2hWu4UO-ZWyVe8wlP9c0JsrduA49xBnRmSLOt8SWaOfIpCwjDLKXMTWJQ5aKj3WakQv6-Hnv9rz?gid=0&single=true&output=tsv HTTP/1.1
Host: doc-0k-as-sheets.googleusercontent.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: text/tab-separated-values
X-Frame-Options: ALLOW-FROM https://docs.google.com
X-Robots-Tag: noindex, nofollow, nosnippet
Expires: Wed, 04 Jan 2023 13:59:08 GMT
Date: Wed, 04 Jan 2023 13:59:08 GMT
Cache-Control: private, max-age=300
Content-Disposition: attachment; filename="DownloadtheofficialSpotifyinstallerforWindows-Page1.tsv"; filename*=UTF-8''Download%20the%20official%20Spotify%20installer%20for%20Windows%20%20-%20Page1.tsv
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Cache-Control,Content-Disposition,Content-Encoding,Content-Length,Content-Type,Date,Expires,Server,Transfer-Encoding
Content-Security-Policy: frame-ancestors 'self' https://docs.google.com
Content-Security-Policy: base-uri 'self';object-src 'self';report-uri https://doc-0k-as-sheets.googleusercontent.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-Su3lyhR6rkL4h6kvXiUzZA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
DNS

download.scdn.co

Remote address:

8.8.8.8:53

Request

download.scdn.co

IN A

Response

download.scdn.co

IN CNAME

scdnco.spotify.map.fastly.net

scdnco.spotify.map.fastly.net

IN A

199.232.150.248
HEAD

https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

Remote address:

199.232.150.248:443

Request

HEAD /upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.8
Host: download.scdn.co

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 80491664
Last-Modified: Fri, 30 Dec 2022 06:00:33 GMT
ETag: "bcb9997f6f9b76e8ae8e90cfa26544a3-16"
Content-Type: application/octet-stream
Accept-Ranges: bytes
Age: 283089
Date: Wed, 04 Jan 2023 13:59:12 GMT
X-Served-By: cache-dub4327-DUB, cache-ams12770-AMS
X-Cache: HIT, HIT
X-Cache-Hits: 27, 0
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, no-transform
GET

https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

Remote address:

199.232.150.248:443

Request

GET /upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Fri, 30 Dec 2022 06:00:33 GMT
Range: bytes=0-11199
User-Agent: Microsoft BITS/7.8
Host: download.scdn.co

Response

HTTP/1.1 206 Partial Content

Connection: keep-alive
Content-Length: 11200
Last-Modified: Fri, 30 Dec 2022 06:00:33 GMT
ETag: "bcb9997f6f9b76e8ae8e90cfa26544a3-16"
Content-Type: application/octet-stream
Accept-Ranges: bytes
Age: 283089
Content-Range: bytes 0-11199/80491664
Date: Wed, 04 Jan 2023 13:59:12 GMT
X-Served-By: cache-dub4327-DUB, cache-ams12770-AMS
X-Cache: HIT, HIT
X-Cache-Hits: 27, 0
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, no-transform
GET

https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

Remote address:

199.232.150.248:443

Request

GET /upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Fri, 30 Dec 2022 06:00:33 GMT
Range: bytes=11200-733779
User-Agent: Microsoft BITS/7.8
Host: download.scdn.co

Response

HTTP/1.1 206 Partial Content

Connection: keep-alive
Content-Length: 722580
Last-Modified: Fri, 30 Dec 2022 06:00:33 GMT
ETag: "bcb9997f6f9b76e8ae8e90cfa26544a3-16"
Content-Type: application/octet-stream
Accept-Ranges: bytes
Age: 283089
Content-Range: bytes 11200-733779/80491664
Date: Wed, 04 Jan 2023 13:59:12 GMT
X-Served-By: cache-dub4327-DUB, cache-ams12770-AMS
X-Cache: HIT, HIT
X-Cache-Hits: 27, 0
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, no-transform
GET

https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

Remote address:

199.232.150.248:443

Request

GET /upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Fri, 30 Dec 2022 06:00:33 GMT
Range: bytes=733780-7332683
User-Agent: Microsoft BITS/7.8
Host: download.scdn.co

Response

HTTP/1.1 206 Partial Content

Connection: keep-alive
Content-Length: 6598904
Last-Modified: Fri, 30 Dec 2022 06:00:33 GMT
ETag: "bcb9997f6f9b76e8ae8e90cfa26544a3-16"
Content-Type: application/octet-stream
Accept-Ranges: bytes
Age: 283090
Content-Range: bytes 733780-7332683/80491664
Date: Wed, 04 Jan 2023 13:59:12 GMT
X-Served-By: cache-dub4327-DUB, cache-ams12770-AMS
X-Cache: HIT, HIT
X-Cache-Hits: 27, 0
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, no-transform
GET

https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

Remote address:

199.232.150.248:443

Request

GET /upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Fri, 30 Dec 2022 06:00:33 GMT
Range: bytes=7332684-31460302
User-Agent: Microsoft BITS/7.8
Host: download.scdn.co

Response

HTTP/1.1 206 Partial Content

Connection: keep-alive
Content-Length: 24127619
Last-Modified: Fri, 30 Dec 2022 06:00:33 GMT
ETag: "bcb9997f6f9b76e8ae8e90cfa26544a3-16"
Content-Type: application/octet-stream
Accept-Ranges: bytes
Age: 283090
Content-Range: bytes 7332684-31460302/80491664
Date: Wed, 04 Jan 2023 13:59:13 GMT
X-Served-By: cache-dub4327-DUB, cache-ams12770-AMS
X-Cache: HIT, HIT
X-Cache-Hits: 27, 0
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, no-transform
GET

https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

Remote address:

199.232.150.248:443

Request

GET /upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Fri, 30 Dec 2022 06:00:33 GMT
Range: bytes=31460303-62040300
User-Agent: Microsoft BITS/7.8
Host: download.scdn.co

Response

HTTP/1.1 206 Partial Content

Connection: keep-alive
Content-Length: 30579998
Last-Modified: Fri, 30 Dec 2022 06:00:33 GMT
ETag: "bcb9997f6f9b76e8ae8e90cfa26544a3-16"
Content-Type: application/octet-stream
Accept-Ranges: bytes
Age: 283092
Content-Range: bytes 31460303-62040300/80491664
Date: Wed, 04 Jan 2023 13:59:14 GMT
X-Served-By: cache-dub4327-DUB, cache-ams12770-AMS
X-Cache: HIT, HIT
X-Cache-Hits: 27, 0
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, no-transform
GET

https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

Remote address:

199.232.150.248:443

Request

GET /upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Fri, 30 Dec 2022 06:00:33 GMT
Range: bytes=62040301-80491663
User-Agent: Microsoft BITS/7.8
Host: download.scdn.co

Response

HTTP/1.1 206 Partial Content

Connection: keep-alive
Content-Length: 18451363
Last-Modified: Fri, 30 Dec 2022 06:00:33 GMT
ETag: "bcb9997f6f9b76e8ae8e90cfa26544a3-16"
Content-Type: application/octet-stream
Accept-Ranges: bytes
Age: 283094
Content-Range: bytes 62040301-80491663/80491664
Date: Wed, 04 Jan 2023 13:59:16 GMT
X-Served-By: cache-dub4327-DUB, cache-ams12770-AMS
X-Cache: HIT, HIT
X-Cache-Hits: 27, 0
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, no-transform
DNS

update.googleapis.com

Remote address:

8.8.8.8:53

Request

update.googleapis.com

IN A

Response

update.googleapis.com

IN A

142.250.179.195
DNS

clienttoken.spotify.com

Remote address:

8.8.8.8:53

Request

clienttoken.spotify.com

IN A

Response

clienttoken.spotify.com

IN CNAME

edge-web.dual-gslb.spotify.com

edge-web.dual-gslb.spotify.com

IN A

35.186.224.25
DNS

spclient.wg.spotify.com

Remote address:

8.8.8.8:53

Request

spclient.wg.spotify.com

IN A

Response

spclient.wg.spotify.com

IN CNAME

edge-web.dual-gslb.spotify.com

edge-web.dual-gslb.spotify.com

IN A

35.186.224.25
DNS

apresolve.spotify.com

Remote address:

8.8.8.8:53

Request

apresolve.spotify.com

IN A

Response

apresolve.spotify.com

IN A

34.98.74.57
DNS

guc3-spclient.spotify.com

Remote address:

8.8.8.8:53

Request

guc3-spclient.spotify.com

IN A

Response

guc3-spclient.spotify.com

IN CNAME

edge-web-guc3.dual-gslb.spotify.com

edge-web-guc3.dual-gslb.spotify.com

IN A

35.186.224.19
DNS

dns.google

Remote address:

8.8.8.8:53

Request

dns.google

IN A

Response

dns.google

IN A

8.8.4.4

dns.google

IN A

8.8.8.8

185.199.108.133:443

https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/scripts/cache/run_ps.bat

tls, http

powershell.exe

4.0kB
114.4kB
55
96

HTTP Request

GET https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/Install.ps1

HTTP Response

200

HTTP Request

GET https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/scripts/installer-lang/es.ps1

HTTP Response

200

HTTP Request

GET https://raw.githubusercontent.com/amd64fox/SpotX/main/.github/cutt/test-cutt.txt

HTTP Response

200

HTTP Request

GET https://raw.githubusercontent.com/SpotX-CLI/SpotX-commons/main/patches.json

HTTP Response

200

HTTP Request

GET https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/scripts/cache/cache_spotify.ps1

HTTP Response

200

HTTP Request

GET https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/scripts/cache/hide_window.vbs

HTTP Response

200

HTTP Request

GET https://raw.githubusercontent.com/SpotX-CLI/SpotX-Win/main/scripts/cache/run_ps.bat

HTTP Response

200
172.67.8.238:443

https://cutt.ly/DK8UQub

tls, http

powershell.exe

797 B
5.2kB
8
9

HTTP Request

GET https://cutt.ly/DK8UQub

HTTP Response

301
142.250.179.206:443

https://docs.google.com/spreadsheets/d/e/2PACX-1vSFN2hWu4UO-ZWyVe8wlP9c0JsrduA49xBnRmSLOt8SWaOfIpCwjDLKXMTWJQ5aKj3WakQv6-Hnv9rz/pub?gid=0&single=true&output=tsv

tls, http

powershell.exe

942 B
9.2kB
10
12

HTTP Request

GET https://docs.google.com/spreadsheets/d/e/2PACX-1vSFN2hWu4UO-ZWyVe8wlP9c0JsrduA49xBnRmSLOt8SWaOfIpCwjDLKXMTWJQ5aKj3WakQv6-Hnv9rz/pub?gid=0&single=true&output=tsv

HTTP Response

307
142.251.39.97:443

https://doc-0k-as-sheets.googleusercontent.com/pub/8hg3b1ek8ops3o87ml9dh1hpus/tajt9egdv69ah7cem92d41m9o8/1672840745000/106179285666896972671/*/e@2PACX-1vSFN2hWu4UO-ZWyVe8wlP9c0JsrduA49xBnRmSLOt8SWaOfIpCwjDLKXMTWJQ5aKj3WakQv6-Hnv9rz?gid=0&single=true&output=tsv

tls, http

powershell.exe

1.8kB
55.1kB
27
46

HTTP Request

GET https://doc-0k-as-sheets.googleusercontent.com/pub/8hg3b1ek8ops3o87ml9dh1hpus/tajt9egdv69ah7cem92d41m9o8/1672840745000/106179285666896972671/*/e@2PACX-1vSFN2hWu4UO-ZWyVe8wlP9c0JsrduA49xBnRmSLOt8SWaOfIpCwjDLKXMTWJQ5aKj3WakQv6-Hnv9rz?gid=0&single=true&output=tsv

HTTP Response

200
199.232.150.248:443

https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

tls, http

1.9MB
83.0MB
34728
59325

HTTP Request

HEAD https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

HTTP Response

200

HTTP Request

GET https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

HTTP Response

206

HTTP Request

GET https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

HTTP Response

206

HTTP Request

GET https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

HTTP Response

206

HTTP Request

GET https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

HTTP Response

206

HTTP Request

GET https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

HTTP Response

206

HTTP Request

GET https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.2.582.gfae9c59b-54.exe

HTTP Response

206
20.42.73.25:443

322 B
7
8.248.3.254:80

322 B
7
142.250.179.195:443

update.googleapis.com

tls

2.6kB
8.0kB
15
15
35.186.224.25:443

clienttoken.spotify.com

tls

1.8kB
5.5kB
14
13
35.186.224.25:443

spclient.wg.spotify.com

tls

2.2kB
6.4kB
15
17
34.98.74.57:443

apresolve.spotify.com

tls

1.6kB
4.6kB
12
9
35.186.224.19:443

guc3-spclient.spotify.com

tls

1.9kB
5.4kB
13
14
35.186.224.19:443

guc3-spclient.spotify.com

tls

943 B
4.3kB
8
7
35.186.224.19:443

guc3-spclient.spotify.com

tls

943 B
4.3kB
8
7
8.8.4.4:443

dns.google

tls

1.6kB
7.5kB
14
14
8.8.4.4:443

dns.google

tls

1.6kB
7.5kB
13
15

8.8.8.8:53

raw.githubusercontent.com

dns

powershell.exe

71 B
135 B
1
1

DNS Request

raw.githubusercontent.com

DNS Response

185.199.108.133

185.199.109.133

185.199.110.133

185.199.111.133
8.8.8.8:53

cutt.ly

dns

powershell.exe

53 B
101 B
1
1

DNS Request

cutt.ly

DNS Response

172.67.8.238

104.22.0.232

104.22.1.232
8.8.8.8:53

docs.google.com

dns

powershell.exe

61 B
77 B
1
1

DNS Request

docs.google.com

DNS Response

142.250.179.206
8.8.8.8:53

doc-0k-as-sheets.googleusercontent.com

dns

powershell.exe

84 B
129 B
1
1

DNS Request

doc-0k-as-sheets.googleusercontent.com

DNS Response

142.251.39.97
8.8.8.8:53

download.scdn.co

dns

62 B
121 B
1
1

DNS Request

download.scdn.co

DNS Response

199.232.150.248
8.8.8.8:53

update.googleapis.com

dns

67 B
83 B
1
1

DNS Request

update.googleapis.com

DNS Response

142.250.179.195
8.8.8.8:53

clienttoken.spotify.com

dns

69 B
118 B
1
1

DNS Request

clienttoken.spotify.com

DNS Response

35.186.224.25
8.8.8.8:53

spclient.wg.spotify.com

dns

69 B
118 B
1
1

DNS Request

spclient.wg.spotify.com

DNS Response

35.186.224.25
8.8.8.8:53

apresolve.spotify.com

dns

67 B
83 B
1
1

DNS Request

apresolve.spotify.com

DNS Response

34.98.74.57
35.186.224.25:443

spclient.wg.spotify.com

https

1.7kB
5.1kB
5
7
34.98.74.57:443

apresolve.spotify.com

https

2.3kB
4.3kB
7
8
8.8.8.8:53

guc3-spclient.spotify.com

dns

71 B
125 B
1
1

DNS Request

guc3-spclient.spotify.com

DNS Response

35.186.224.19
35.186.224.19:443

guc3-spclient.spotify.com

https

7.6kB
6.1kB
18
19
8.8.8.8:53

dns.google

dns

56 B
88 B
1
1

DNS Request

dns.google

DNS Response

8.8.4.4

8.8.8.8

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
22d85b17177521d41ac7269bf2169654

SHA1
9c1bac7cf28dfb010c5130665e8c9fbf2589c769

SHA256
d967105c3d716efd65273c3dc41bde17ed67a5c26805cbe63490ca382bfc5362

SHA512
50b76814fb80123c876ba8a75e333e69b655a62acc9e12d648561d134241872171d58dee81853d8a39b3477994a050dde8d515742945817f194e52046e2fb91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
3KB

MD5
3ba68415f3f5feac4ef5d45ed93344e9

SHA1
cc90c22b4740c0ca3003d8cdca8966cf42db86fb

SHA256
c4b876af513a4401e59efebb235d0f64c412696389da7ee69ad2429d2e38ac78

SHA512
034efdd4c0798dd607dce4dff77f69b7e605fd1c8669df44c0bff40a4417e95556c948998d385cf91916fb7c35b23d791d6ddaa0f04c653bed5a155fd26ec86a

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
797c9172331c90a73c2c2043f6162f89

SHA1
0d702a4ab1a3526c2b9451999cbf32ea810114b7

SHA256
7feaef2e62c914e28a70327c03eca93031a5f6b1dd02b24a43d3ded79f709cf5

SHA512
5f09cff9d90477574286e46ebffeb0b390202f48b9d332c91f42396f3cf418c963eac747f146b091ceffa2c82c7d4415bb8b632e7a7c296b6c567f4f83b11567

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk

Filesize
1KB

MD5
2eef3aa48bfbc1a3505e37be7b9ad56c

SHA1
5ceb25c4dfbbae023f3e8f489ca00f39f89e394d

SHA256
8bc603f11d817cf490e443ee76aa6427b89e2373323b642698ce98e63cd3e689

SHA512
f5f0142ee933e93766bb9be3e81283a84e199e8472e2d90e2fcba68d3e7a215b5eb9dc82dea98da255d6bfb5a33b1887cd25a71ef5c545bd358a9730b95f5f30

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
1.5MB

MD5
13e24f25cda69b8d22a24171ef824ef8

SHA1
b4fceabe143c01cb46254df27cb10244465f13d0

SHA256
82d9ef9b6a8e7fd48bcde8723a89d7b8efd6bf37c50364d2b9c848b7efacd524

SHA512
c18be0a26fc4788cbddc095c449f30ec24682bc79ce84f786fc508cb2c6a4e1803e6ce93fc986b3a5d91b0ef439e9539be27c51c186d4b542e5934f668427fef

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa

Filesize
5.8MB

MD5
ac1247632fb1e9ea9419b9023614f809

SHA1
c97a5320798e8fb6354b5b3cfd0c37e5dd6788f2

SHA256
c8667081dff7afb55a87e23b2db027d9afc85daa5afb99dd40b2a1ca9b278661

SHA512
cd6531b70b7475385f8b4d4319a114b1512b9e6fa9cbea45f244cd6d5f91ddc1faa5ebc879debbb1de6b5f234245515a0e0ab45b620bc0bcf824538b1e7aa53f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll

Filesize
3.9MB

MD5
bce6d0f16abb8d6605ee69e889b37eb7

SHA1
037f19a44a5fa263c533e1185c8aa15200adf0ad

SHA256
67822622dc963c583530930e8011615ed7d1131911dcca493f6fbf443fa9d8c6

SHA512
9211b423135a76e97391f295e147668afad3dde84582450df6acce68bcd3ba79040cdb18f8375b5abb9d9d35692b5504ddbb64a2249b24c2996a9e9cfaf82ce0

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
16.2MB

MD5
396bd55e468212892d09ca0aaf13a44a

SHA1
012597e5fca32b2e66a815eebaf30a3ede8fa3eb

SHA256
f4efd81b34fea3a3856a74947f09f79f6153190c7e204dc8dfdb577a0e7083f7

SHA512
86819d4df00f07042b2a1fee51a135c2f3dc8076ccd9d946a7957f1d6540e38d4c98a7a073e2ea2b686d081a9dad1edf743875b458b4137fdead0e20e3931c56

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
16.4MB

MD5
bdeedab3106bc671901ff52c768f84d6

SHA1
8e14ea6af368e839d7e8f15a4fe8d8d9f9c02252

SHA256
5e5a2164a9662e5929ec1bb4e60447177a217942cb591022025e0ca5ceaaab70

SHA512
4267c13afb7d4cd23b4de3c731210fff0302d1d54abfc2f85918a5ad2937e440678a9480a93fae659f8c05e4cee343d4cef8c9dcf651ad109e0f5786e5116e6b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
15.4MB

MD5
514bfc2f14d9e3c1e35cbb63bc30c2e0

SHA1
842dad1bc381887b1fee9a876a7c24d02948ae47

SHA256
afe4be560fc77aea857a03ea54e8f3edb107db4f2bf765c4cb02c14b307df5bd

SHA512
1b56c825845c5f4ec8b581f447250d63bdedafa99ec425525ca58429fc50cc620f0c14abc29baadd789376faf47056cfa5b46a32e89f9d7c92426c9543be7570

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
c6a69fd7c4045c7f2c99b5b112691d98

SHA1
5d683f621e08d85d18183c4bd8fe5cdc2bdf3715

SHA256
0c227c533c826f6af8abd2107e83cd8469eddb723afb7f64aa39d2eeaec0a3b1

SHA512
7b1fedb97bb3a66c9c9538e12e25dc654b949800f6c46767394f404bea09e3ba5c5e3b63b041d58edb756b538c30e32767be1091f4e25b31fb66cf52f4ac286f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
19.4MB

MD5
10d6ed4bf5138847afa115c7309842f6

SHA1
6be2a3d93abb785a867469e4547f2d652855ea7f

SHA256
5a9c9eed465d0846d9f35283fca2e043769adada4696270480164be3ae4fa67b

SHA512
990973138839746d44d3103843564066b47a227b2bc8d61f0390ae1fbbfad733b8965ce9e35648060ef8a6c064dae0bbe35f1e64d28689a1cbfa9bcdc94d9e03

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
18.6MB

MD5
8369b75afba1582708ebb85bc8f47486

SHA1
87716d94365f9f18edbf79c63a8fd1f60556accd

SHA256
c54dd4b83b786c102fd21f8ebe92187f995c42e63d6538a13fa074d5543a7e91

SHA512
3d99a71b5f973f017727a561c784325c0b4080107fcd2cba7c2c7360a626bb403e7226a3774026838f369c2292fa83cc58c7adc2b0be3d346d33861c6df6e332

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\cache\cache_spotify.ps1

Filesize
1KB

MD5
9135756b852ffd77aa0a83f88bff19e8

SHA1
fab30b8d88748b1b798b425450dd2569f1fc3c00

SHA256
60a93b8c0bf82de8d8c2b6625c3fe3d50f93bec4de8a539de78c8a6ad5973b4c

SHA512
54749cd245f7a9b7cffda52529fe8acc846e1327ce69dfd056620e3dfe70f633f9357b04e9872f6cd4dc9585cd57e1926355611001889bd2eb649a998611e32e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\cache\hide_window.vbs

Filesize
140B

MD5
ed0a06e0e24e1f94e608bca03eb5eef2

SHA1
f079d2a3d6b0ef0657e6dfeb8c278ec5bfc1ca20

SHA256
1a817aa66979c8100608692bc29722fc97e1955460614a7263fe24e1ecdb71b2

SHA512
cf78e0053c240541e02cbccd51f5414cd0ba2e884c7c0693fface365ebc46e382b1eef3a4f74f53c983a3055252cd7273f95159e959bfa6b0e64bb5e5dba187c

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\cache\run_ps.bat

Filesize
154B

MD5
f951690de39de946d6fc21f8f2ad967a

SHA1
ec4fff9088ac01bef6aba452550afc1e054f7023

SHA256
d37d21a54f78a7cd1c297109fc51c1f186073daf24bd3b90d623112de8f10c7f

SHA512
ed0a3871eb7da077d5b57c42ec8d5251b912e1ef808ec54fa32736547ff675ae7d9cc02e00f9521c7b639b861d80b0594b5b15c60cce4cc41f56bdfcb72e14cb

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
600KB

MD5
22cffa11d298c474eb466547b5c0097b

SHA1
80d1a13cfeebc1c190838987bcbbec627f4b8c1a

SHA256
d785afc8953892615e480244010b5b25e364f51ef7410214dd883f1d8eb9532b

SHA512
a0df258f240317837314af43b5d9b6ff8b23d9e6a25a07cf6d1d5d26e678729fbd7857670378a879b973b568fd1dffd519ebd2e60e54ba9e26fab5333ae2b23b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
897KB

MD5
237a94cdebd069e219675e525b18a13a

SHA1
691bc1dda1d23e39efa8a25b289e0c4a6a5861ab

SHA256
0aa52b4ed48daaa75412f1a06cebf47fb1e03b5081e052a2f78034d725ce83ef

SHA512
dcfe0f4e4d458c419a245def6e0a972dcfc4bfb34e08865e72eceec87c28b0dd3f44bdc15d4e6ebb05f06d83cccee17158caacc35e564f2133b0524a8cf17d97

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
654B

MD5
c191f9ed1ae79d50e0b75f6d40375911

SHA1
cea54226f42cfbb83a3db9bad22474f4489f94a2

SHA256
d66bbe643943fb21a3c7e56a0b041bb010c6cb14cc4d5dd1f96eb889e341e7e9

SHA512
89d74342cc68d154733e6c4678ff5198b1f4033ff0a4be0c0aa64e2e74f39c2eff39cd8c1c9dfe716132d7b685d0694fbbfb5508ef507e3d2bab3fde296abb9a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\debug.log

Filesize
219B

MD5
c67829bcc8e55035bda4c8fc552858c6

SHA1
17969ef9ffadb139bfa37e3c85c3b2924cf5000a

SHA256
2d69165bffb2f842735fa720df204eeeb652b7c9cd80b276ad79c9cc1932d7e4

SHA512
13a90010862cf634f205ae5377e8b2ac224be53a19771dd8b7942a47ae5201068fe283676d26ab54738f9a5139f787d8e10f0ae8e738ba1e381de95e35282c76

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
25d87a2bb3581bc3597dfb9008516710

SHA1
e3f59f1de852cde2204256c7a8b1580483ab907a

SHA256
b75bd14a3d9a174ee44eca8c62b89c65d9836fcf62c28d103bfa300c02cef255

SHA512
59977fa5ec1dbda7cb6525c48655d6e8f3d7b00408e973efed1f2235d1d7fd88eae443fdd5e07d52f31ce83943aba050c31261baf2798c1b10aeae67981685ff

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
41.6MB

MD5
94f8cdbd50aa5e22a9d677a072e5255f

SHA1
0979de97c7a6ccdaa8c7e660f914cab8189d7323

SHA256
35343f877dcefb2f7d54f478129ffbc37aa5c0616d6ac8f46ab51a2c00c1eb7d

SHA512
5c97bb73bdc8ffd5ef6ca6136f87cd45eb786557ea39a84fd9fb18f568d77558f6f214ac99437f767709807d86f5fc105b98dd9556177c74d779195e12296940

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll

Filesize
356KB

MD5
bf71eebc1b3a6f2a3a460ec40c0189a6

SHA1
beaeea459eb2a510a2644cc1c65b6993a4e782b7

SHA256
1db4b63469b1c31a2dc47915527a03132383b232d260e85cb8f2c8a4c5b3945a

SHA512
346077f696d87560c1ef7fa56c3a66bbcfa65dea3e0b0c5895db17e63581f5b26ae8e001b592d46b95a403a83ebde0a59e6fd2b51300d70584a5ea237fda777f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll

Filesize
5.4MB

MD5
e6f1df3cd185ee63fd0aa3decba3380d

SHA1
2c1da1115fe2f350e698680842aad008e5c77fa6

SHA256
5d13e04492f3ed595070ed3a1d48d29daf804ca02238ed0f2fef14865d1ce439

SHA512
72bf24071a2fc8324543a56561b8e401fa00757ebd2a01e320a1fdf6f31f876dd7465c392055a6162e1336b7e08d2b3c6ce0e197cfdda88370d8b84f4d8fbf95

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
337KB

MD5
f84dd97190589d26f5ae3721ff2e86f5

SHA1
a73ebc5bb9fba50141e9e399cd170db80de21bb8

SHA256
0cdf3bd5efe01c54962d382b90a670a747391e4e56d1b3e012bc207a292f564a

SHA512
727ca0321210dbab5384f33164b43e8490de837e837dec540480bddd4e899c551021a4500ba493c18513caefe7a875b5c4a6e33e3b4d07ff8f631ae1d07d576d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\es.mo

Filesize
14KB

MD5
0201c52b0aa81af14e438967c965c72c

SHA1
d6d2afe463ee8b05c7b53bd89471039cc273c340

SHA256
8331df25cd78028d98758444cdd9545b3cd6aa5579cc30c19e26e4e79d4c818a

SHA512
a780ce4ab1a64c64d008efc72c59568e3caea109884bf8cdc12bf11a648e814945f3a12defa355076bff5251b15b20ab99912fdbfd073d83b9a274e332a47cca

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
7.2MB

MD5
509c75095d1f285fcf14b152d7746d91

SHA1
5f75577267d44f97a15c9b7d75f289ca7bb8c0a2

SHA256
f76ec95f2fc27c20a4fd8d8dc0b6d17185617204bfbb21ae5269725d6a237c9a

SHA512
a1522f0b3f191e0f85c6d2faa641a6efa6e8dccc3f6ab489d4a2787949d4a9407d8c4065e0fb620a3eb7da7052351a1cccd50aa0be930e46b64f699aaf9e99af

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
590KB

MD5
fd33582b82e5b1e69d18ab4ea1ffad8e

SHA1
0aa2759a29c5592a7ca4170bc4f5bc679b8f66d6

SHA256
55680689bd6daef8d546a530c9dd069fcd560be68430653577118874fa0be8d3

SHA512
c46e656d6cb7b336681ab2f4170a911e13ef804c70ef05033dd64fa7cc8e910958a0be3056907c8330cdef0e5d11a3a5c9d1de9cffa5bade79f6a408f16af90a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
3.5MB

MD5
f1b7a423c6e9f302bd2410ca8842198a

SHA1
03dde3f2513e598650f5b12e8d5288f06410cb93

SHA256
bc9636ea5582f2bff2401c2d01e044eda9e20eec9404169737d388cd68a78840

SHA512
4670fdcb6bf5fac0d1622292bdfccf04b6de48e51be66ce854f32b78c996fc62316a034d37cf411a32f605ecf33a668d5189e6e225fd199c88122d8b490ab49d

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader_icd.json

Filesize
106B

MD5
8642dd3a87e2de6e991fae08458e302b

SHA1
9c06735c31cec00600fd763a92f8112d085bd12a

SHA256
32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9

SHA512
f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll

Filesize
714KB

MD5
6d955287d7576f0ddd2f5a80ca6101c8

SHA1
421e8783ba6056367db58e93d4506263b71bd6f0

SHA256
4d29040978877a946f09c74fa94b1fcb0a5a58ec86b6e18546e1cf8803a3878f

SHA512
64192de602e119fd278e4ecc33c4e7a444875b93fd2e43f6037e85c15e1acbd942fa67c51402dbd7e6661dc93f76e2a41f1e543a344fa54a0a31ebd913027a89

Download Submit
C:\Users\Admin\Desktop\Spotify.lnk

Filesize
1KB

MD5
493ed2c7b591dbfc7c045acd089fa36e

SHA1
0ee22a8ea6308143c91b35ca3458138fbe811704

SHA256
7a74552fbd6fd50080210de38c75107c74d86b2586b7f87d9a8588249e329c32

SHA512
73dba8e720eff00cbf6ab6873a9f8621bf07b50b8035ebc17d2cf1a447b560fe546b09ee59ee9987ebc9a8ca07769dc1443feff2120e8bac89dac7716c6883b8

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
985KB

MD5
19b36e31417f22370f27a452af52ca32

SHA1
cf1ca15393093575d7b0ea802328450ef577b77d

SHA256
dda87c28310f7f41802938a7ce3f9df3099f20bc5cb8f9d0f331f4f167e55a7a

SHA512
811b0b5a609534f9fd639175cd619ade6ecbdad0227dda46d0555b4c4a14b5e11a52a326af817aa7dde6f8d4090f6c025633e580b76bd35b21b9b147dd50335b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
3.9MB

MD5
bce6d0f16abb8d6605ee69e889b37eb7

SHA1
037f19a44a5fa263c533e1185c8aa15200adf0ad

SHA256
67822622dc963c583530930e8011615ed7d1131911dcca493f6fbf443fa9d8c6

SHA512
9211b423135a76e97391f295e147668afad3dde84582450df6acce68bcd3ba79040cdb18f8375b5abb9d9d35692b5504ddbb64a2249b24c2996a9e9cfaf82ce0

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
356KB

MD5
bf71eebc1b3a6f2a3a460ec40c0189a6

SHA1
beaeea459eb2a510a2644cc1c65b6993a4e782b7

SHA256
1db4b63469b1c31a2dc47915527a03132383b232d260e85cb8f2c8a4c5b3945a

SHA512
346077f696d87560c1ef7fa56c3a66bbcfa65dea3e0b0c5895db17e63581f5b26ae8e001b592d46b95a403a83ebde0a59e6fd2b51300d70584a5ea237fda777f

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
5.4MB

MD5
e6f1df3cd185ee63fd0aa3decba3380d

SHA1
2c1da1115fe2f350e698680842aad008e5c77fa6

SHA256
5d13e04492f3ed595070ed3a1d48d29daf804ca02238ed0f2fef14865d1ce439

SHA512
72bf24071a2fc8324543a56561b8e401fa00757ebd2a01e320a1fdf6f31f876dd7465c392055a6162e1336b7e08d2b3c6ce0e197cfdda88370d8b84f4d8fbf95

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
13.9MB

MD5
c81c7206a72bf146a7840e38266bfe9d

SHA1
59dfa63395cb2df43d08c72723e3d355bd3e41de

SHA256
6603249fa548544078beb359f25784778617c3a46092d9bc5e06c86797e793fe

SHA512
65b75cbc46eca254e2ccb1a263ae6229f4d236da36f1ee043a41a54334e0866c4edd642e9e7e5f1bd3f5ed64bb9561681fb33682692f7233da2f7063c26406ef

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
11.8MB

MD5
08e214575b8fd69de2e448ebb7c1f66a

SHA1
b0adee93b62c7e9fcf75ff547e23b8da12bf70b1

SHA256
8d015a066faa753f176e9e0aa255a963fc82d558d7f9d1d09a39e9dd28872c8e

SHA512
6adee1808f863ab45d9d4e7f4ffe92ee6eb23f7e946262e0b649c7ecf9e70415b9cdcd4a484a0e9d1befe8263c28ad08862f32f96c2ab6bde15c3b4fc5e71772

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
10.8MB

MD5
93fe48369e4292b2f4b40064e7979927

SHA1
7ee426534bbd11576e87485e6aa7deec1ad592e9

SHA256
613437630a6273ad3d931f1633647ae2781d1d6d3750e0cc13ac41996f30be7e

SHA512
7c12fc3bda6d1f2e32973b310c15639d03e240fca9efd9b85d66014c18c2ea1d4cf65a9b29ecf57e7259dd072ff23f353c0d6fa9ee05d00a69ed308bf2e9c927

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
6.8MB

MD5
ae35e5c6003532a3e3717c1f807f20fd

SHA1
2faa59b9115f176cc6562698c54feef5eab95fcd

SHA256
d3587223f948bd840abcc1f206a73bc6cca3fb59dbcfcae6dac1fa19fb802ba7

SHA512
0120e302c01a19b8fdfb044d81cadece43b9ec6cd6e0a4b132a5fcc6c3c61abfd309d959aab8ba08767ecc61d32532b5384575cb0651ccb929ad920dd270715b

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
37.3MB

MD5
2c7086811eda3252edc09cfc1984be13

SHA1
bf28d62103d4d566841ca64d528e993d5bb8e263

SHA256
cb5d71eec7ce22387c9488fc18308bfcb829e33055da061a78816ec873ecd80b

SHA512
10cc14e62286262e31fc92bbe2e3c552750ede0c37a30e289d902e18686003a6865a32aff26330ff4ad21ff04794ab4e615f537e774b9d02b3439242cef7b390

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
20.2MB

MD5
18ef832a5b1f294c7d401d77ffde46a6

SHA1
ae76ec5d2b86fb510d019f74adc12c6c32dfcbe6

SHA256
a91aac65d8d87daf99ec83da7e41bf2b3cca1398c7b7d81634b99297d6e4e375

SHA512
bc99ce07a8364d625c247beebc5782ad9bc40b446d43afa2e0c8bf2e6c8e842eb37035cd30a827d82a286ac922a9c67b50ab48c1503b910282cebe379d6aed37

Download Submit
\Users\Admin\AppData\Roaming\Spotify\libcef.dll

Filesize
20.6MB

MD5
e542c8dcfda3fed1e2d64ce0dc3d85f2

SHA1
93018e981686c2a8035855b92174d7286ac72b41

SHA256
0f88f0b04ff9e819ae8f72d88c23bec9c18d254b7886690fc22fe8cfccc74c3a

SHA512
546f9aa03ed6cb708323ca866c863bf506e54513c82e2eaf1a6f848d858e9bdde6248966e8aca50b570f515a4a6b2d2f441af9e5a3b66b87b59c5201cd5331f1

Download Submit
\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
3.5MB

MD5
f1b7a423c6e9f302bd2410ca8842198a

SHA1
03dde3f2513e598650f5b12e8d5288f06410cb93

SHA256
bc9636ea5582f2bff2401c2d01e044eda9e20eec9404169737d388cd68a78840

SHA512
4670fdcb6bf5fac0d1622292bdfccf04b6de48e51be66ce854f32b78c996fc62316a034d37cf411a32f605ecf33a668d5189e6e225fd199c88122d8b490ab49d

Download Submit
\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll

Filesize
714KB

MD5
6d955287d7576f0ddd2f5a80ca6101c8

SHA1
421e8783ba6056367db58e93d4506263b71bd6f0

SHA256
4d29040978877a946f09c74fa94b1fcb0a5a58ec86b6e18546e1cf8803a3878f

SHA512
64192de602e119fd278e4ecc33c4e7a444875b93fd2e43f6037e85c15e1acbd942fa67c51402dbd7e6661dc93f76e2a41f1e543a344fa54a0a31ebd913027a89

Download Submit
memory/1616-1173-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/1616-1467-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/1824-412-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-396-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-397-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-399-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-398-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-393-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-394-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-411-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-414-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-404-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-409-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-405-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-406-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/1824-407-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/1824-408-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-413-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-352-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-403-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-402-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-401-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-395-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-347-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-348-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-349-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-350-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-392-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-389-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-388-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-387-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-386-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-351-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-410-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-385-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-384-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-354-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-383-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-382-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-381-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-380-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-353-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-356-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-379-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-378-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-377-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-355-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-376-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-357-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-358-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-375-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-374-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-373-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-372-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-371-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-370-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-369-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-368-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-367-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-366-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-359-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-365-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-360-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-364-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-361-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-363-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/2096-362-0x0000000077700000-0x000000007788E000-memory.dmp

Filesize
1.6MB

Download
memory/3180-1412-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/3180-1071-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4056-1344-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4056-987-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4204-947-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4204-665-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4296-1154-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4296-776-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4360-434-0x000001E9EA9C0000-0x000001E9EA9D2000-memory.dmp

Filesize
72KB

Download
memory/4360-208-0x000001E9EA080000-0x000001E9EA08A000-memory.dmp

Filesize
40KB

Download
memory/4360-120-0x000001E9E9A50000-0x000001E9E9AD2000-memory.dmp

Filesize
520KB

Download
memory/4360-121-0x000001E9D1400000-0x000001E9D1410000-memory.dmp

Filesize
64KB

Download
memory/4360-433-0x000001E9EA540000-0x000001E9EA54A000-memory.dmp

Filesize
40KB

Download
memory/4360-420-0x000001E9EB250000-0x000001E9EB776000-memory.dmp

Filesize
5.1MB

Download
memory/4360-419-0x000001E9EAB50000-0x000001E9EAD12000-memory.dmp

Filesize
1.8MB

Download
memory/4360-122-0x000001E9E9AE0000-0x000001E9E9B02000-memory.dmp

Filesize
136KB

Download
memory/4360-312-0x000001E9EA100000-0x000001E9EA112000-memory.dmp

Filesize
72KB

Download
memory/4360-273-0x000001E9EA0B0000-0x000001E9EA0D2000-memory.dmp

Filesize
136KB

Download
memory/4360-123-0x000001E9E9C20000-0x000001E9E9D22000-memory.dmp

Filesize
1.0MB

Download
memory/4360-201-0x000001E9E9C10000-0x000001E9E9C1A000-memory.dmp

Filesize
40KB

Download
memory/4360-200-0x000001E9EA030000-0x000001E9EA044000-memory.dmp

Filesize
80KB

Download
memory/4360-126-0x000001E9E9DB0000-0x000001E9E9E26000-memory.dmp

Filesize
472KB

Download
memory/4360-143-0x000001E9E9D90000-0x000001E9E9DAE000-memory.dmp

Filesize
120KB

Download
memory/4360-133-0x000001E9E9D70000-0x000001E9E9D84000-memory.dmp

Filesize
80KB

Download
memory/4712-1056-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4712-782-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4888-1407-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download
memory/4888-1060-0x0000000000400000-0x0000000001784000-memory.dmp

Filesize
19.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.