6c2dee1494b8d8ca09163a1fd87be156defc3884101e6dfe23267829d0e6b758

Analysis

max time kernel
95s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpotX-main/Install_New_theme.bat
Size 277B
Sample240224-sdfkksfa79
SHA256 fa7ff9975dce1fc26987f6457ee9ef5e9a9fbe4d21b68a34941343f5cb00651e
MD5 bf78a0583ee16de7cf3776c7c7ad23fc
SHA1 30d6cf358f8932007554e5a5ef2f3ccf83c90e8a
SHA512 8a154d83996fbf0ba5f3c13514c48484824238d5d42aa7bcb44e399b996c249b66edaf722080101db0a7b4e8b93ca6028ac27ef565b9dfc7169d62466cf8f5ab
MD5 SHA1 SHA512

Score

8^/10

discovery

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	3592	powershell.exe
13	3592	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3888	SpotifySetup.exe
392	Spotify.exe
2852	Spotify.exe

Loads dropped DLL 4 IoCs

pid	Process
392	Spotify.exe
392	Spotify.exe
2852	Spotify.exe
2852	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
13	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 3 IoCs

evasion

pid	Process
980	taskkill.exe
5820	taskkill.exe
6140	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeIncreaseQuotaPrivilege	3592	powershell.exe
Token: SeSecurityPrivilege	3592	powershell.exe
Token: SeTakeOwnershipPrivilege	3592	powershell.exe
Token: SeLoadDriverPrivilege	3592	powershell.exe
Token: SeSystemProfilePrivilege	3592	powershell.exe
Token: SeSystemtimePrivilege	3592	powershell.exe
Token: SeProfSingleProcessPrivilege	3592	powershell.exe
Token: SeIncBasePriorityPrivilege	3592	powershell.exe
Token: SeCreatePagefilePrivilege	3592	powershell.exe
Token: SeBackupPrivilege	3592	powershell.exe
Token: SeRestorePrivilege	3592	powershell.exe
Token: SeShutdownPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeSystemEnvironmentPrivilege	3592	powershell.exe
Token: SeRemoteShutdownPrivilege	3592	powershell.exe
Token: SeUndockPrivilege	3592	powershell.exe
Token: SeManageVolumePrivilege	3592	powershell.exe
Token: 33	3592	powershell.exe
Token: 34	3592	powershell.exe
Token: 35	3592	powershell.exe
Token: 36	3592	powershell.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	5820	taskkill.exe
Token: SeDebugPrivilege	6140	taskkill.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 3592	1580	cmd.exe	89
PID 1580 wrote to memory of 3592	1580	cmd.exe	89
PID 3592 wrote to memory of 980	3592	powershell.exe	94
PID 3592 wrote to memory of 980	3592	powershell.exe	94
PID 3592 wrote to memory of 5820	3592	powershell.exe	95
PID 3592 wrote to memory of 5820	3592	powershell.exe	95
PID 3592 wrote to memory of 3340	3592	powershell.exe	98
PID 3592 wrote to memory of 3340	3592	powershell.exe	98
PID 3592 wrote to memory of 2728	3592	powershell.exe	99
PID 3592 wrote to memory of 2728	3592	powershell.exe	99
PID 3592 wrote to memory of 5488	3592	powershell.exe	100
PID 3592 wrote to memory of 5488	3592	powershell.exe	100
PID 3592 wrote to memory of 3600	3592	powershell.exe	101
PID 3592 wrote to memory of 3600	3592	powershell.exe	101
PID 5852 wrote to memory of 3888	5852	explorer.exe	103
PID 5852 wrote to memory of 3888	5852	explorer.exe	103
PID 5852 wrote to memory of 3888	5852	explorer.exe	103
PID 3888 wrote to memory of 392	3888	SpotifySetup.exe	105
PID 3888 wrote to memory of 392	3888	SpotifySetup.exe	105
PID 3888 wrote to memory of 392	3888	SpotifySetup.exe	105
PID 3592 wrote to memory of 6140	3592	powershell.exe	106
PID 3592 wrote to memory of 6140	3592	powershell.exe	106
PID 392 wrote to memory of 2852	392	Spotify.exe	108
PID 392 wrote to memory of 2852	392	Spotify.exe	108
PID 392 wrote to memory of 2852	392	Spotify.exe	108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpotX-main\Install_New_theme.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "&{[Net.ServicePointManager]::SecurityProtocol = 3072}; """"& { $(Invoke-WebRequest -UseBasicParsing 'https://spotx-official.github.io/run.ps1')} -new_theme """" | Invoke-Expression"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im Spotify.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:980
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im Spotify.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -V
    3⤵
    PID:3340
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -Is -w "%{http_code} \n" -o /dev/null https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.31.1205.g4d59ad7c-1561.exe --retry 2 --ssl-no-revoke
    3⤵
    PID:2728
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -q https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.31.1205.g4d59ad7c-1561.exe -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-02-24_15-01-56\SpotifySetup.exe --progress-bar --retry 3 --ssl-no-revoke
    3⤵
    PID:5488
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-02-24_15-01-56\SpotifySetup.exe
    3⤵
    PID:3600
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im Spotify.exe /t
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-02-24_15-01-56\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-02-24_15-01-56\SpotifySetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.31.1205 --initial-client-data=0x414,0x418,0x41c,0x410,0x420,0x74e73b0c,0x74e73b18,0x74e73b24
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Size 56B
SHA256 770c475739525c3fefb39e722932cbd67e1cc2d6c4eca468a9596c7987beb002
MD5 d02290eb701e5b90361c08df1ffbc322
SHA1 543e1ae05bc507e817e4139b61e339c734869577
SHA512 0f2c7b32b292407b140267cf96a640bdbf5be4fa192b8f22653bd58d47277ab5d284413a9c6d5d3838d2c77a61b23b94b759da4add17cd47053bebcbc292eb25
MD5 SHA1 SHA512

Submit Download

SpotifySetup.exe

Path C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-02-24_15-01-56\SpotifySetup.exe
Size 10.7MB
SHA256 69bdace6dec3fffe0d6330910dd82579e6dfc345413606f0d35c3aa032e17b4c
MD5 d8f3569e59cb080a70864e9cdc9e19aa
SHA1 74fcb992304b2db7a0982444a787942a29d37146
SHA512 b8dcaf477b4c4e908f94f2e2d07f6a140adfa33749ee0d063203dd35bb2f89457f3fcab0a218a9da17c7dffaf21b415bf2f3fb0dae962d839addab3525d04678
SSDEEP 196608:J6lBetpfbsMQrZ/vXmoQkGF26C3xNc5loXxnI4gsJ8PiMphnPf:sl6pf4xrZn0Xknh1CPiIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

SpotifySetup.exe

Path C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2024-02-24_15-01-56\SpotifySetup.exe
Size 4.8MB
SHA256 41c77c1e5ca9ddf4137c63b8e61c39543aee605cb221109e6342c6f93efc34d6
MD5 bcc5fac07408dc4289a01f7e0617f91f
SHA1 9cb0eb6079001666ec4e643dd55b577a848d0a96
SHA512 e6342bd78f5b317e9aec4f90ee1038a3544ecf198256149d323d3d8fd6bf030ac04652f24b880a71500392b5701601c00eaf78b7e195b01a58cdda23c5af38ce
SSDEEP 98304:J6P+qBp9BRx/SW2pUVIVbsDoQrzGssuN9hdI4y4eomtCTl:J6lBetpfbsMQrZ/vXmoQkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_u04go5z4.2kw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u04go5z4.2kw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.6MB
SHA256 be4177b4458cde95a402346120368e55229e370e7806a91ac8eb5f2e8ff77f56
MD5 c7440dcab39772ae15ddbd8d0432a2f1
SHA1 92b6ddea20d10184a3b07c5b9463b7b41a5121f6
SHA512 6a324f7b78726445952d37682fc56b368ed39b76e40fd9c1958af5731f04b115fa3a67cd7ba5023b7591c4420d01c238299c21a5ee499d910195059d31ee6f75
SSDEEP 49152:m8pVNzzBNx+xdidSeTHbLfnGpTpfBMDwCgH8I73nOJaHy1rG53g8rRqurLGboDtJ:jnXNCdidSmHbLfngpfi0CLIjnOJ0y1rq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.6MB
SHA256 30c0d3ef3b71f4f31b8e91c5a36965876059482348ba19cf068ab22e275f493d
MD5 43b09fdcb1eeeb6969f00f9be4784726
SHA1 8a2d67dbbb9d8a51d59301b8a00d768c9aae322e
SHA512 0f00532631f758bbbbf4aad279cb48d93ee45aafb1cb9697369feafa6ad7ed796cc7cfd0a1011ac32bda47f4520ca42c8023a06153311c8506f6978a990fa761
SSDEEP 49152:m8pVNzzBNx+xdidSeTHbLfnGpTpfBMDwCgH8I73nOJaHy1rG53g8rRqurLGboDtm:jnXNCdidSmHbLfngpfi0CLIjnOJ0y1rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 928KB
SHA256 06715e60a9747326388130cf5a0ca8bf99e41adfcae938fa5af43224ff1f48c2
MD5 108d912ef10f6ed904a47fb615a5782b
SHA1 2f3f678e1f41ba356c2e49f31329a0d8710cb828
SHA512 272970807ef354b34accc9f89137b80662d262dd1c683326531477a9249e17015da49b4ddf209376c891e6633cdc20d571b7e376e88d567556540e3d5a681ece
SSDEEP 24576:m8pXFEpje5Zamoql/Nx+xdidSeE52HCgLwWwOocfJMh:m8pVNzzBNx+xdidSeTHbLfS
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Size 723KB
SHA256 7fe5c8576bdca841ac43598eb50fc872a0f8562e49f831b872bcfba877beeadb
MD5 8769ca49abae6664f018947546577d16
SHA1 26805c113867845a210fba76dc089967f4e28e0e
SHA512 feaf9052a72ef519d596214bc5159c0c0b34989a8d36c588c267799fecf5b027f01434e1d574bc78ad007afe213f08b91bdc7b24ba5161363ad002c02d579869
SSDEEP 12288:dI3H1fJqjzgsz5B0GDJQrnKs8SNP+QSsSilRBdNz10Mc+gIXalhJw6iFjjZboO02:63VBq7zEEmPLSOdNz10ygU0zevboO0Tq
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Size 861KB
SHA256 1b707508790d95a3a44600df258c381fef912deeb1b1b67bc6a21b226d324221
MD5 832d1cbb365a9938ef8ea49990faf692
SHA1 6166d6d28432317f2e3a78b778d0aacc97f6093d
SHA512 0df1f255c11121a6abea4a19ec78d2f9818505d179c5e5befa6a05635dbde410f0f906e3a0f6a42025f88707a3429319f35ef9860721a5e10dcc19ec7bd8e2e7
SSDEEP 24576:L3zBr5zLmmibkFR8+mZRUumegvQt80yUwvdVlM:L3t53mNbkFRJmHURhQC0yJvdTM
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 1.0MB
SHA256 b114e5bc03ac4a06a24549d190b7ac2ea6d7c3da75b5428df3d55f0dee86b945
MD5 3e4161e7f4f843e551bf7bf2fe46976f
SHA1 0e51786266faafd20c7f5b7bc75de6d6340883f3
SHA512 225a49bbbd34c037ac3a8948daef8436b8a3e634e0eab63bb48007c14cefc43992c7f203510143bc5aaa993b1654cd5ce4d5a8aa3f4abb712eb0018840e11215
SSDEEP 12288:hNXjZ0wXt6gRfmWx57CPzQ5QhTAe5JvEg/PCeEJ55QWFYyV35:hNTZ0wIgRLIcGhTAevEWPCegayP
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 754KB
SHA256 38da9404d99da7c2e90aeec2575f10bb258abd7bfc8d7d68f649449453b3e70c
MD5 c9399136d1afaa94ea9ebae5dba5773b
SHA1 7813f95fa92dfc52af55177af5deba012cc1e7eb
SHA512 92146124d9d51a15743905b594dab71c717c3e1feeed4a1a2df5d1c1190a5f6601213549e6548b641c78f9782663dd99cf9ab23d9e5a1f3da55f78578e18d1ad
SSDEEP 12288:hNXjZ0wXt6gRfmWx57CPzQ5QhTAe5JvEg/PCeER:hNTZ0wIgRLIcGhTAevEWPCeG
MD5 SHA1 SHA512 SSDEEP

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 682B
SHA256 ca8fca68d1115503e0f54c7cdd6f998d1f2a7a370fa794def287cb41fdc3bf15
MD5 34d129dafd5b37eb13bee55abb256d17
SHA1 2467f3c162b0766f237d1f604ab88285bfb6aef0
SHA512 0d512a84ad71dfe3148b0e9ca2ceaa728c591be87910583ec1ffe454d4746f9672983051c3db1baa08aaed0d9d7f27bf0ba6becd27b2ae23b3efcb6be1f7dbdd
MD5 SHA1 SHA512

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Size 813KB
SHA256 fc94f225bc67a2e32bf5788d51541b3a2d74d7c834a4a7f7d67f958a4a573d9b
MD5 a5c1daf5761b68d34523553f704ceb3b
SHA1 bd9d64a0690b59e607288423751c1220df5973fa
SHA512 ac3fc0e759b591ae7f6a540712e43909c5884b7f0fc12d5c573cb28ab20d20d8004288e935b85baf9101e9dbef4efafa2763dd50f380d977c78305d81e5f3d0f
SSDEEP 12288:hoc/mSWt60ouQoFDdtFMlhw771h0jM7ykPG07N8ox/2UEwlgYWpbEJ6k:hpkjchw3zVtjnjEw+A8k
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcef.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Size 1.7MB
SHA256 8a84b8378ac697fd043942706ff2fa9295362c9c63bda71d087567515e9fcc9e
MD5 c1dea1e3fb741d00ced81d9727259c24
SHA1 c2aad3fe535c893cdf5cb0d58c3ac5b149bf89d7
SHA512 a52cdfa85d23213344f6c63470d0c75446bbe43817923c7c2b88a1790853ec3d760e89fad3ddc1ec36d1962d11d52da65565ac8ab9622f64aad9553b7ad7d00b
SSDEEP 49152:/6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwU:/666666666666666666666666666666S
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcef.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Size 1.4MB
SHA256 1bf599d67ab25fa5e7fc8f46490ca621190aea79003ddc6df54b00047f08fd61
MD5 68eadd7e7055df0cc95056748c64ca6b
SHA1 e7212f954eae08630242d9afcbd2a38061aceae7
SHA512 67a9cf806f3dd504c1dcc47525526a7064b139a08c8ba1ca05ed76fadfbc48a7f66a2f08ef87d0291ae560de8852d972a0e85d747675fc433ff84b426da25458
SSDEEP 24576:zL6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwQ:/666666666666666666666666666666n
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcef.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll
Size 714KB
SHA256 2bc1815796c7cde64e0fe459f278af3b61318f68325fde4135c350bd00211ec4
MD5 8ae7c0dd9e2e31cc38587f450021c6bb
SHA1 3b9c721a9a293bfe2e260702e2d493554fdb59c8
SHA512 157cfd598e31131f496ce750be811a819bff1511db11f4ede7071611babef18d7647ca30a9edb6cfb2f0982706eba5871eee0292679fd8cbee297dbbdef8469a
SSDEEP 12288:1xYmL6666666666666666666666666666666x666666666666666fwwwwwwwwwwU:zL66666666666666666666666666666D
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Size 448KB
SHA256 e5c1d7bf50fda5013c333006a00a1a1725a06ddca4d77ff2506179f472645695
MD5 62cf97caa1e687a5fcfde34c4831ff20
SHA1 b72b9dd1ed2004967288e005997596fc99dc5f37
SHA512 95cace9b76d9ef82705b9572f534638f418c8fe8a7668a7d08503b20a19d471e76ae1ab0c8edb4af2b1b675d5ce38ea5981cac0077751542fe5135dcca79afd4
SSDEEP 6144:4Ludxdhlegw2c9STRMP9e63D0faYbwer/5zSongF/iwPwp:4y77ALoFMt3DyX5zSDPwp
MD5 SHA1 SHA512 SSDEEP

Submit Download

en.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Size 14KB
SHA256 f6cd90b187d9a45961c73a626516ef339f366de6b1fd056e4f2d37741d1ad07f
MD5 3feae9611704bc133a2f21b43249e76d
SHA1 5ba87d4ff02e6d0e4c1effde63a5a3cae41359dd
SHA512 63d774c57b563a6846a41859c40b38378f4aa338e580171797fd4d7a83f84da1c2819be8b017bdbf7dd7d37f9796a733b212a595a62c223ca9c26c09472624d8
SSDEEP 384:BpTbL8gYgPJGpyNhA9ozXyAKmyc+Qp/DiNhA9ozXyAKmYTdut:fWWsGrGd
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Size 930KB
SHA256 edeee466496eb720a4ffec0b4276fcea60248ce7b92338c35deceecd7c810dd2
MD5 6faeb9e9260a3e7b1b1cf858c746a693
SHA1 8b0b1ba002456288adcc43e537ece37c7fd46425
SHA512 fcdf5a54e2ad6933df927d4a68de8dfcc9ff18d627322f7b97813078973a3ed14feda1b8d8af88fdeb5ef5fa1e3010d8dbc77b17de6567ac647f99dc43aca490
SSDEEP 24576:d4HSi9yO0Z+RmmibkFRZDoOQJ1GqHo7LABy:d4HTV0YRmNbkFRZDhQLGyogy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/392-244-0x0000000000400000-0x0000000001A31000-memory.dmp

Download

memory/392-226-0x0000000000400000-0x0000000001A31000-memory.dmp

Download

memory/2852-248-0x0000000000400000-0x0000000001A31000-memory.dmp

Download

memory/2852-245-0x0000000000400000-0x0000000001A31000-memory.dmp

Download

memory/3592-1-0x000002017F140000-0x000002017F162000-memory.dmp

Download

memory/3592-222-0x000002017F180000-0x000002017F190000-memory.dmp

Download

memory/3592-17-0x000002017FF20000-0x000002017FF44000-memory.dmp

Download

memory/3592-16-0x000002017FF20000-0x000002017FF4A000-memory.dmp

Download

memory/3592-22-0x000002017FFF0000-0x0000020180004000-memory.dmp

Download

memory/3592-15-0x000002017F180000-0x000002017F190000-memory.dmp

Download

memory/3592-14-0x000002017F180000-0x000002017F190000-memory.dmp

Download

memory/3592-13-0x000002017F180000-0x000002017F190000-memory.dmp

Download

memory/3592-12-0x000002017F180000-0x000002017F190000-memory.dmp

Download

memory/3592-18-0x000002017FF20000-0x000002017FF36000-memory.dmp

Download

memory/3592-19-0x000002017FDB0000-0x000002017FDBA000-memory.dmp

Download

memory/3592-11-0x00007FF875270000-0x00007FF875D31000-memory.dmp

Download

memory/3592-20-0x000002017FF90000-0x000002017FFB6000-memory.dmp

Download

memory/3592-26-0x00007FF875270000-0x00007FF875D31000-memory.dmp

Download

memory/3592-246-0x000002017F180000-0x000002017F190000-memory.dmp

Download

memory/3592-247-0x000002017F180000-0x000002017F190000-memory.dmp

Download

memory/3592-21-0x0000020100040000-0x0000020100066000-memory.dmp

Download