dc1a411c116e88abf0f5c65ac6f3af71921d24f4446b99a7c07f06cb62e5a762

Analysis

user interaction
yes
max time kernel
899s
max time network
481s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpotX-main/scripts/Install_Prem.bat
Size 609B
Sample260715-chjvsshv9p
SHA256 dc1a411c116e88abf0f5c65ac6f3af71921d24f4446b99a7c07f06cb62e5a762
MD5 8abb79c6baa7ab3cabe68dea37eb0cf5
SHA1 3f5ce7534f424b9e82dbf46bc8fa40a564d78f6f
SHA512 95853f0d253c9fbac130bd078a66b2dc0441f7e4ea2c44735eb819dee5b86954916b0b945f4b61e94c3d3b33ae9c2266704f0494ed9f75e3138f7493d9ce9d88
TLSH
T1CCF002B3D14E1B694C4B04F5700A6BD8418FA682E796C0AF12F74B849CC63DC8794340
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1440	powershell.exe
8	1440	powershell.exe
10	1440	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1520	SpotifySetup.exe
5344	Spotify.exe
4224	Spotify.exe

Loads dropped DLL 2 IoCs

pid	Process
5344	Spotify.exe
4224	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com
10	raw.githubusercontent.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1440	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AppUserModelId\Spotify.desktop.launcher\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpotifySetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AppUserModelId\Spotify.desktop.client	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AppUserModelId\Spotify.desktop.client\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AppUserModelId\Spotify.desktop.client\CustomActivator = "{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}"	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AppUserModelId\Spotify.desktop.launcher\DisplayName = "Spotify Launcher"	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AppUserModelId\Spotify.desktop.launcher\CustomActivator = "{18A68F64-72DD-42CE-A75D-EDBDAC226F5D}"	SpotifySetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AppUserModelId	SpotifySetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AppUserModelId\Spotify.desktop.client\DisplayName = "Spotify"	SpotifySetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\AppUserModelId\Spotify.desktop.launcher	SpotifySetup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeIncreaseQuotaPrivilege	1440	powershell.exe
Token: SeSecurityPrivilege	1440	powershell.exe
Token: SeTakeOwnershipPrivilege	1440	powershell.exe
Token: SeLoadDriverPrivilege	1440	powershell.exe
Token: SeSystemProfilePrivilege	1440	powershell.exe
Token: SeSystemtimePrivilege	1440	powershell.exe
Token: SeProfSingleProcessPrivilege	1440	powershell.exe
Token: SeIncBasePriorityPrivilege	1440	powershell.exe
Token: SeCreatePagefilePrivilege	1440	powershell.exe
Token: SeBackupPrivilege	1440	powershell.exe
Token: SeRestorePrivilege	1440	powershell.exe
Token: SeShutdownPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeSystemEnvironmentPrivilege	1440	powershell.exe
Token: SeRemoteShutdownPrivilege	1440	powershell.exe
Token: SeUndockPrivilege	1440	powershell.exe
Token: SeManageVolumePrivilege	1440	powershell.exe
Token: 33	1440	powershell.exe
Token: 34	1440	powershell.exe
Token: 35	1440	powershell.exe
Token: 36	1440	powershell.exe
Token: SeIncreaseQuotaPrivilege	1440	powershell.exe
Token: SeSecurityPrivilege	1440	powershell.exe
Token: SeTakeOwnershipPrivilege	1440	powershell.exe
Token: SeLoadDriverPrivilege	1440	powershell.exe
Token: SeSystemProfilePrivilege	1440	powershell.exe
Token: SeSystemtimePrivilege	1440	powershell.exe
Token: SeProfSingleProcessPrivilege	1440	powershell.exe
Token: SeIncBasePriorityPrivilege	1440	powershell.exe
Token: SeCreatePagefilePrivilege	1440	powershell.exe
Token: SeBackupPrivilege	1440	powershell.exe
Token: SeRestorePrivilege	1440	powershell.exe
Token: SeShutdownPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeSystemEnvironmentPrivilege	1440	powershell.exe
Token: SeRemoteShutdownPrivilege	1440	powershell.exe
Token: SeUndockPrivilege	1440	powershell.exe
Token: SeManageVolumePrivilege	1440	powershell.exe
Token: 33	1440	powershell.exe
Token: 34	1440	powershell.exe
Token: 35	1440	powershell.exe
Token: 36	1440	powershell.exe
Token: SeIncreaseQuotaPrivilege	1440	powershell.exe
Token: SeSecurityPrivilege	1440	powershell.exe
Token: SeTakeOwnershipPrivilege	1440	powershell.exe
Token: SeLoadDriverPrivilege	1440	powershell.exe
Token: SeSystemProfilePrivilege	1440	powershell.exe
Token: SeSystemtimePrivilege	1440	powershell.exe
Token: SeProfSingleProcessPrivilege	1440	powershell.exe
Token: SeIncBasePriorityPrivilege	1440	powershell.exe
Token: SeCreatePagefilePrivilege	1440	powershell.exe
Token: SeBackupPrivilege	1440	powershell.exe
Token: SeRestorePrivilege	1440	powershell.exe
Token: SeShutdownPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeSystemEnvironmentPrivilege	1440	powershell.exe
Token: SeRemoteShutdownPrivilege	1440	powershell.exe
Token: SeUndockPrivilege	1440	powershell.exe
Token: SeManageVolumePrivilege	1440	powershell.exe
Token: 33	1440	powershell.exe
Token: 34	1440	powershell.exe
Token: 35	1440	powershell.exe
Token: 36	1440	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5248	explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 1440	3412	cmd.exe	88
PID 1440 wrote to memory of 4976	1440	powershell.exe	91
PID 1440 wrote to memory of 2852	1440	powershell.exe	92
PID 1440 wrote to memory of 788	1440	powershell.exe	93
PID 1440 wrote to memory of 708	1440	powershell.exe	94
PID 1440 wrote to memory of 4760	1440	powershell.exe	96
PID 5248 wrote to memory of 1520	5248	explorer.exe	98
PID 1520 wrote to memory of 5344	1520	SpotifySetup.exe	99
PID 5344 wrote to memory of 4224	5344	Spotify.exe	100
PID 1440 wrote to memory of 5212	1440	powershell.exe	102
PID 5212 wrote to memory of 3004	5212	csc.exe	103

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpotX-main\scripts\Install_Prem.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-premium -new_theme'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/spotx-official.github.io/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/run.ps1' })} $p """" | iex
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -V
    3⤵
    PID:4976
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" --help all
    3⤵
    PID:2852
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-51\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.94-x64.exe
    3⤵
    PID:788
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-51\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.94-x64.exe
    3⤵
    PID:708
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-51\SpotifySetup.exe
    3⤵
    PID:4760
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ccbbllr2\ccbbllr2.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5212
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1CD2.tmp" "c:\Users\Admin\AppData\Local\Temp\ccbbllr2\CSC86D508BA51B14EF5B614DF1732C386A3.TMP"
      4⤵
      PID:3004

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-51\SpotifySetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-51\SpotifySetup.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe /INSTALLCOMPLETE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.94.582 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ffe12955448,0x7ffe12955454,0x7ffe12955460
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5460

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1CD2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1CD2.tmp
Size 1KB
SHA256 f2f6687213531a9c2e5bf8fa2a5cb5d9536a8f175ee7450379a47d3c8d2523d1
MD5 4a63df39caccb29488df5a1629411d80
SHA1 8f50183cd1ae607ccf5911b55aa96a27a2780d64
SHA512 f713c90b23eaf5d3c550b46d407b72ab704e520d495487c39166de26e7e818bd8d9335fd5b37b2cb05941981c8c42c854c77302a330f6dd664c9249b0e31fdd5
TLSH
T1CA21DA0043E8430AF0B74732BDFA175B9278FD64AFA2A35A844042282C41604EEA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

ccbbllr2.dll

Path C:\Users\Admin\AppData\Local\Temp\ccbbllr2\ccbbllr2.dll
Size 5KB
SHA256 649c4c519985652c038f055533812e850184183ec605846285149f700927fd50
MD5 c9f795c38f36a6458469bbf6293a1dce
SHA1 7dea2e2d152d312af7588ee5612971210ad8d038
SHA512 af5d98490391481aeb726153e2824945e3f6c192d290c26c157ba23b75b7151d89c52aec535cf1b98647f596ee05e5e9f52419eb5334e53dd8c86259485df555
SSDEEP 96:rpY3XHnArOtNAvw8Z2bYKHeSqYGbEjbbNjcWmK:VoXvrAdKHNZbZjX
TLSH
T174C1E60B23D86663E6775B3AA5F3034293B0F814E263E32B7448527CAC705B85D22BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpui.spa

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
Size 10.7MB
SHA256 9461357ea5139a830c2dad562476421c216e4f1d8cbf4c138a1017cc72cddca8
MD5 2ff9a380db836de6851614e0cebf0bc5
SHA1 dc1928a3a5c04c996df9b2fc1a3cd045661fec88
SHA512 5e4404837d43736da69ddac3e8a79a3671d0468af468c14ba0fcda7e1d1d16092fa979a3f6c5142022b7f87afbf2c3bdf572884739810a8f7d6b8cd8649ec788
SSDEEP 196608:192D9prd8V4qNiTsdIqkqf+yeAkQ1U0cI9fv7Isl9/PYTG1gy6a+Pcn3s9R+XjUE:KPE19kq7XkiUbIZv7Zz/L16D0cLIWm
TLSH
T137B633FDE1E04DD1CD2BB236DC0F4BA9848F5B810235E656AB298B96250F1C72EB05D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpui.spa

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
Size 12.5MB
SHA256 ca27e7f3e1bce94da0f19aa0d0d3d7d1e77f76e49d137b45ed122a52d2eb3730
MD5 f29a0110508660ff9b1101a8b3d70f70
SHA1 400ae3b4a75d2d51f8ee57350285624ee34238d2
SHA512 d82f2aaefd1ba9dda22b81d52a5695d13dc168506c5f0fb55c4745988e1b69460c9bcf651a4a5d58b869660e4edeee59eedaebee6b4f28ac4a7b8d8cd907152c
SSDEEP 196608:1V2D9pGPBV4qNiTPdIqkof+YeAkQ1U0cI9fv7Isl9/PYTG1gy6a+Pcn3O9r+X/aM:y/EE9ko5XkiUbIZv7Zz/L16D0exQsn/S
TLSH
T1B2D633EEE0E04D81C92FB336D85F5B69C08F17904236E6059F298BDB644F1C66EB059B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xpui.spa

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
Size 12.1MB
SHA256 78285c099d8ef0314889dccfc234c033d742c38e9ca51665895c31f87f4918a2
MD5 1852c27860f8fa30a304a1ac885ff937
SHA1 c471c11f64e58f828f29eaea5f57fe2d276303d9
SHA512 e24de4e68a2653c0a539d2436f8adf5d627f61e00ce8d2f44d3fb273c73c626013980773b7ba88f46173df92689888661c0430a84c132f200ffa6b00aad48609
SSDEEP 196608:ZGVG3I2D92+8fYWCjxzhG5ZfXBOjYi8L4sdDzm4VPb/v9r+X/aehmHL1oeQ+Im:Z2G7k+8fjCjxzuBUWxQPhmHL1oN+Im
TLSH
T13AD633FDD6D408C2C46FB738D80F9F54845F1FD11622AA196A1A8FC6291B1CBACE4397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.1MB
SHA256 d80248f68230f2241871956652b5b0a3c3c26db4d8638ff9b92b5d27507056e6
MD5 85b69f188475d644b1a5737b12eef106
SHA1 06b0eb8e7ad7fd94c60209c4d0f313a1f1150bfa
SHA512 eff8015743ced6b9733cfac96e0bcedbe737e4455cd8380694a18bd5fbff59dd0bcfc468884774be6a5b1ab4ec5bb4d71f96d84ca14d7c52848782bc2a2307f8
SSDEEP 393216:dYus5wYYOTezMCM3fyzBBTTTQwxnEySu2XvpyYA:CeXvGu2Xv+
TLSH
T1CC978D9B71E401ECC0AAE1BACB139C17D777744A0731E38F02E492A25F67A60567F762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 40.1MB
SHA256 bc16307430cab4bdd7b19da6a5b48ee957d1bbc1b4a292e5d05a42d47de412e2
MD5 eab4fe4ef8adc6cb3b462f3ac92ebf6e
SHA1 3516f22a19cc1b4b03da09b9b9dd22ed8a5c3d51
SHA512 3e041ff894ebcc3d4b851653c898aa02db15504af2b31bff6bc7988b7b83f9d26a05cc244a39d91e997b19de3afdc32ff15a10be16f2b4d11071916015c0e261
SSDEEP 393216:dOus5wYYOTezMCM3fyzBBTTTQwxnEySu2XvpyYA:keXvGu2Xv+
TLSH
T128978D9B71E401ECC0AAE1BACB139C17D777744A0731E38F02E492A25F67A60567F762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 aace19a4f713561183a37db6ca01f1343e431acaba36816003a8f0bcbdb3c875
MD5 eff5646ee32d2a8176556428b582ab5d
SHA1 c2b5d935d8c5223eae451dba799e8551d05013bd
SHA512 9d3c8ae0b7323aafd5237a394f507729bb8ce7c9ea17aea6697dc5eeb6b4acf932745357e064d023d14c2ec1a20c9373594a99852ca1094fa8bc141fa8952daa
SSDEEP 49152:1HYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+did:1HYg8xwfGrUA9Ncnas8jdk
TLSH
T1FAD57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 1c82eefb8145e92f8d267f7fea87b475ad084f7611c71c8df38ca2b8c31c96e7
MD5 d07f466409e2f1bb1279459f8bcdef30
SHA1 b1f708abd84c30587c6508e61cb90d5f96ca171d
SHA512 0365df74a9f7a41332fc73bd7bb0195ac8bd3a4f52690d640dc1c22ff00361695fadf36420ee653af2a8681c2c6b3598408d80a68139f0ba19b1c3e5e484252a
SSDEEP 49152:9LOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l19:9qG2qe6JBKDtXmKj9
TLSH
T15FC56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 632B
SHA256 7b1be81fe871975a15d22d0bc0b0d5bf31909eeda5d91a5a86b846239991ddd1
MD5 47bb2763587ceed848f0ba55d384d248
SHA1 a7866cafb3acf12df575c512890be231966a7158
SHA512 c0fd9e2d49589313c457ccb682825a28d592e5396e851daf2f918065e1c4bf2ec387ec500ee858df782b1d2665dfede68d7ad8f9ff720d3b54479cbb1c3bff73
TLSH
T1EFF02DFF59D0657990F10BA2E03C63107CB205951B2B805846531F993B48F69CE5DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

zh-Hant.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
Size 16KB
SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
MD5 d41d181d619aef4a1af14bcd6ad2fc1c
SHA1 05ea268a59c887a92387a2ad2925285901bba1ba
SHA512 b2ed7c0c97672411266ef55cfed4e98a7d812e85a20706140c8ea8c566677ed9bdcfaac7d0656496e34db5a7a50e0c9e810fe9a18c2039630745ce617513b605
SSDEEP 384:pFTaUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/na5k+0SyIqLvsZXPuD:LxOXq+LBDXPuD
TLSH
T15E72175B1932CE38D5378B7E5B9F3624E63B612C5ED164342BEFB41423C636A16E2053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Size 16.6MB
SHA256 0187a9dd2e67d224d261785ef4235e804392ba1a24d20c2556c5c751e65d0800
MD5 cf377703fbee9c7c0530acc0c58eeceb
SHA1 a1e80f4cacdc1667ecbdc28cbea285c433fd4cc6
SHA512 527f2c121163ba9bb5d3d3bf842f02f908c0aceebcd6bb166a514b3558aa4a4c2c5d11785417c0f9e417ec543a9516f4f65324820410041bb651d0b21c8c06a1
SSDEEP 49152:jMK4h4UrzskpzKDURNdmbVi7bnIOStH+qCXxw/3wBjdiEEFJA:AdF8JA
TLSH
T148074680E7F95348F2F77F65EEBA90564836BE96ED29C75E0405050E0831A4C99BAF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC86D508BA51B14EF5B614DF1732C386A3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ccbbllr2\CSC86D508BA51B14EF5B614DF1732C386A3.TMP
Size 652B
SHA256 5412f77e358bfa8134c3bd7cf0d8fd31844139f8fae7338251d6bd93d6a73b6d
MD5 68f2fa35a1e0338a6bdbfe21b3cefeba
SHA1 6e3f0e3284523476e89dfedfcc9849d9ceda719d
SHA512 cd364e76dffce954235917cc271a8d1df741732397b181f7ecc78648c086fc06b80df66e9ececeacc3a8bed025a31e63229e6835b524528803e8d2c474614a2e
TLSH
T152F05E0963F8020EF0F38B70BDF643A395A8BC64EE3293ED548043192864A149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ccbbllr2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ccbbllr2\ccbbllr2.0.cs
Size 8KB
SHA256 78e0ec5b518d24be43e349f9306c1410c602ffe34136e1c5c97369747d266633
MD5 0215dce390f89b8078f8fd351be5e75c
SHA1 d5601a7273c9de0e2107aa8ccdb0f4ffea0f150f
SHA512 51b7e2e8cf526c1eac869c3ac4d03821f06e31e9932fbb4f1c0b63b90a26f2bc1c485d3ad47c04661400d0b617ef0bad0a02fdc3fe53e2bef9794831c3cddbde
SSDEEP 192:icCqCAv803CAvd77oiSCyc5hBC+Bl4VyiSCJdKbyfFE5rmEyAyi8y8:iQvw+j4I2amG2
TLSH
T14B02008C5EA35A194B43313C5FCA1509F721F82702CDFE09BC1D5680AF59936A2B5BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccbbllr2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ccbbllr2\ccbbllr2.cmdline
Size 369B
SHA256 6ddb57658b8d0bac41bf0912321aa79c022d5433145ce3ad7cee4f0871680577
MD5 477efb1c1ecded035fa595d06fc2332f
SHA1 6d6a810672e70e11d3285654ece048e22045ebb8
SHA512 ced8201ed3853ef5d82a3dbf875c53f56f15462e634bc80d8c85683c33e36552f102d76c8b17e5f6e1ee6897ea18bb42452677b38d7ca730edd7f1a31b698ece
TLSH
T17FE0C06A4246C27D01DD200B21E9CCECC2F217432AC03F949450C88DF42701167D17CD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1440-22-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-45-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-23-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-25-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-24-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-20-0x0000017DD62A0000-0x0000017DD62CA000-memory.dmp

Download

memory/1440-26-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-16-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-27-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-28-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-29-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-30-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-31-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-32-0x0000017DD6430000-0x0000017DD65F2000-memory.dmp

Download

memory/1440-35-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-36-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-34-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-33-0x0000017DD6B30000-0x0000017DD7058000-memory.dmp

Download

memory/1440-38-0x0000017DD62E0000-0x0000017DD62FA000-memory.dmp

Download

memory/1440-37-0x0000017DD7270000-0x0000017DD7474000-memory.dmp

Download

memory/1440-39-0x0000017DD63B0000-0x0000017DD63DA000-memory.dmp

Download

memory/1440-40-0x0000017DD62D0000-0x0000017DD62D8000-memory.dmp

Download

memory/1440-43-0x0000017DD6320000-0x0000017DD6328000-memory.dmp

Download

memory/1440-42-0x0000017DD6310000-0x0000017DD631A000-memory.dmp

Download

memory/1440-44-0x0000017DD6360000-0x0000017DD6386000-memory.dmp

Download

memory/1440-0-0x00007FFE1D4AF000-0x00007FFE1D4B0000-memory.dmp

Download

memory/1440-41-0x0000017DD6300000-0x0000017DD6306000-memory.dmp

Download

memory/1440-46-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-48-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-49-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-21-0x0000017DD62A0000-0x0000017DD62C4000-memory.dmp

Download

memory/1440-18-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-19-0x0000017DD6260000-0x0000017DD626A000-memory.dmp

Download

memory/1440-17-0x0000017DD61A0000-0x0000017DD6252000-memory.dmp

Download

memory/1440-372-0x0000017DD6AB0000-0x0000017DD6ABA000-memory.dmp

Download

memory/1440-373-0x0000017DD6AE0000-0x0000017DD6AF2000-memory.dmp

Download

memory/1440-15-0x0000017DD5E70000-0x0000017DD5E8E000-memory.dmp

Download

memory/1440-12-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-11-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-10-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-9-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-8-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-7-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-6-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-5-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-403-0x0000017DBD570000-0x0000017DBD578000-memory.dmp

Download

memory/1440-4-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download

memory/1440-3-0x0000017DD5C90000-0x0000017DD5CB2000-memory.dmp

Download

memory/1440-412-0x00007FFE1D320000-0x00007FFE1DCC4000-memory.dmp

Download