Overview

overview

8

Static

static

3

Spotube-wi...up.exe

windows10-2004-x64

8

Spotube-wi...up.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 15:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Spotube-windows-x86_64-setup.exe
  • Size 36.5MB
  • Sample260727-tbcatahn6v
  • SHA256 e5641f3841ec724fcb5e00a22d980f410ee507fdd00669b86db0c29f9b741162
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 36 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Spotube-windows-x86_64-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Spotube-windows-x86_64-setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\is-21FFH54RLZ.tmp\Spotube-windows-x86_64-setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-21FFH54RLZ.tmp\Spotube-windows-x86_64-setup.tmp" /SL5="$401D4,37068857,893952,C:\Users\Admin\AppData\Local\Temp\Spotube-windows-x86_64-setup.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\is-O5RG2ELS6A.tmp\vcredist2022_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-O5RG2ELS6A.tmp\vcredist2022_x64.exe" /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4968
        • C:\Windows\Temp\{08D54FC4-BA34-45D1-AEFB-1E7DCE48804D}\.cr\vcredist2022_x64.exe
          "C:\Windows\Temp\{08D54FC4-BA34-45D1-AEFB-1E7DCE48804D}\.cr\vcredist2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-O5RG2ELS6A.tmp\vcredist2022_x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /passive /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2060
          • C:\Windows\Temp\{526CC762-8EF2-4010-B2EB-F7A902861F2B}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{526CC762-8EF2-4010-B2EB-F7A902861F2B}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E1138735-791E-4025-B914-B7F364698BEE} {C4D32BC6-40B4-42EA-AB87-719C77BFBE02} 2060
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1616
      • C:\Users\Admin\AppData\Local\Temp\is-O5RG2ELS6A.tmp\vcredist2022_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-O5RG2ELS6A.tmp\vcredist2022_x64.exe" /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Windows\Temp\{245951E0-60A7-48E9-ACA8-CAF1850178C1}\.cr\vcredist2022_x64.exe
          "C:\Windows\Temp\{245951E0-60A7-48E9-ACA8-CAF1850178C1}\.cr\vcredist2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-O5RG2ELS6A.tmp\vcredist2022_x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=488 /passive /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3496
          • C:\Windows\Temp\{17D45FC9-4BC4-4920-B289-AC6D0DE64C74}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{17D45FC9-4BC4-4920-B289-AC6D0DE64C74}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A95F8135-2984-4D6E-812C-452A02A3E487} {C51347A9-7331-4830-9356-D6C1A5939BF0} 3496
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:4716
      • C:\Program Files\Spotube\spotube.exe
        "C:\Program Files\Spotube\\spotube.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4340
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2000
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4864
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:924
  • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260727165350.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260727165350.log"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{17AD8116-D9ED-45D5-AC55-4DDBBDD15E05} {58D90250-DB44-4775-8A43-1CB245E73DB6} 2988
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4560
          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1000 -burn.embedded BurnPipe.{2B30D7D7-9009-4C5A-9659-F414D1E51CFD} {435DD661-A90B-42BC-B20E-BE2E364100E8} 4560
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4268
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1000 -burn.embedded BurnPipe.{2B30D7D7-9009-4C5A-9659-F414D1E51CFD} {435DD661-A90B-42BC-B20E-BE2E364100E8} 4560
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2532
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A8384DF7-4330-443E-90C6-AB6584B7C8BB} {5CD8C3AC-B340-4C47-BC0A-B818A2BB1E33} 2532
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:5608
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
    1⤵
      PID:2412

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a1fe2.rbs
          • Path C:\Config.Msi\e5a1fe2.rbs
          • Size 19KB
          • SHA256 a67b4f3126c336a3376dfa6d4bc29b117b180b74d96c767fe9cf5213cb36cdec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a1fee.rbs
          • Path C:\Config.Msi\e5a1fee.rbs
          • Size 19KB
          • SHA256 07e41c98417c46cde9983edbfac5dc4541541624d2d26e4bd1f40d14fe33b190
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a1ff5.rbs
          • Path C:\Config.Msi\e5a1ff5.rbs
          • Size 21KB
          • SHA256 a60251ce80c0ae20de4824a1373efc48755432f6bf8eab36df1f3b1e2f80037d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a2004.rbs
          • Path C:\Config.Msi\e5a2004.rbs
          • Size 21KB
          • SHA256 547b0f2ce1e15c27813945df8725e10c52bbef80838734130324b917b11c9ef4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app_links_plugin.dll
          • Path C:\Program Files\Spotube\app_links_plugin.dll
          • Size 136KB
          • SHA256 09b7972ab04ff5b3331f2bfe10a8b08c51d37071968285f2ae46b1583c30aa70
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bonsoir_windows_plugin.dll
          • Path C:\Program Files\Spotube\bonsoir_windows_plugin.dll
          • Size 211KB
          • SHA256 95c7d2b03ae3f606857baacfb6ad27c0a01bb343195b485c6214230eceff05a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          connectivity_plus_plugin.dll
          • Path C:\Program Files\Spotube\connectivity_plus_plugin.dll
          • Size 97KB
          • SHA256 2ebd130ca581a938459279bb35753e488a59553127d3be5be1ed6c5d44f5c92d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-BP5WL9RHKH.tmp
          • Path C:\Program Files\Spotube\data\flutter_assets\packages\country_flags\res\si\is-BP5WL9RHKH.tmp
          • Size 173B
          • SHA256 5448eb004a2d751685a6e2157fad9bc3fdd6fb7a603703201f4dbcd550fb9186
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-I1UKU4B7YL.tmp
          • Path C:\Program Files\Spotube\data\flutter_assets\packages\country_flags\res\si\is-I1UKU4B7YL.tmp
          • Size 173B
          • SHA256 50bdf1f79d20003d6fd36715918d340384e19aea4d79240980dfc21875419eb3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          is-PPSNJ505HV.tmp
          • Path C:\Program Files\Spotube\data\flutter_assets\packages\country_flags\res\si\is-PPSNJ505HV.tmp
          • Size 34KB
          • SHA256 bc0ae11b614339ce70976762c29059fe8b9bbf3ef810f05fe2862ab6d787b3dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          desktop_webview_window_plugin.dll
          • Path C:\Program Files\Spotube\desktop_webview_window_plugin.dll
          • Size 195KB
          • SHA256 468b630a79f23af6c8e0b17eb6bfb2451fe33848f72ab4191f734230d3b71033
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          file_selector_windows_plugin.dll
          • Path C:\Program Files\Spotube\file_selector_windows_plugin.dll
          • Size 109KB
          • SHA256 b19a5957badd6a877d2a909c2e7205abc008ecd60fb37065ca8b1558b48ae5e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          flutter_inappwebview_windows_plugin.dll
          • Path C:\Program Files\Spotube\flutter_inappwebview_windows_plugin.dll
          • Size 945KB
          • SHA256 fd811345f3984d2a2cccb2accd15d0ec37023ec6c8d3cb3d8facfd7f41838b4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          flutter_new_pipe_extractor_plugin.dll
          • Path C:\Program Files\Spotube\flutter_new_pipe_extractor_plugin.dll
          • Size 87KB
          • SHA256 fe97f8493387b9ae7fe9e885e8cdee9d230a7e3bcd1c445596f64917ff62dd37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          flutter_secure_storage_windows_plugin.dll
          • Path C:\Program Files\Spotube\flutter_secure_storage_windows_plugin.dll
          • Size 156KB
          • SHA256 e12a1324086e167d86bced14460be107bfb1c80b7221ea59066b8fe9ee91c30f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          flutter_timezone_plugin.dll
          • Path C:\Program Files\Spotube\flutter_timezone_plugin.dll
          • Size 81KB
          • SHA256 c62349285b1bca0c8481f66694eaf86c373f1aaad40d05f9b3297b694463d868
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          flutter_windows.dll
          • Path C:\Program Files\Spotube\flutter_windows.dll
          • Size 18.2MB
          • SHA256 dd156c0e10ca662e10d7a556fc0c0efd4603c27f36980a5d9130fd3a3dc6ad95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          local_notifier_plugin.dll
          • Path C:\Program Files\Spotube\local_notifier_plugin.dll
          • Size 161KB
          • SHA256 d7eede45d2cc0fba24910bf26ef1b6af00089c2abe3d3cffb5613a62a53008c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          media_kit_libs_windows_audio_plugin.dll
          • Path C:\Program Files\Spotube\media_kit_libs_windows_audio_plugin.dll
          • Size 12KB
          • SHA256 fd11cc7eee3f8ede48fb2c2c93f032f21bfa2f3bcffcb12d7b91297db0495b38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          permission_handler_windows_plugin.dll
          • Path C:\Program Files\Spotube\permission_handler_windows_plugin.dll
          • Size 117KB
          • SHA256 764f9ed20ddb807b75a01259a99d4066084fe4f3d19ee81f075e3c63f99f3bf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          screen_retriever_windows_plugin.dll
          • Path C:\Program Files\Spotube\screen_retriever_windows_plugin.dll
          • Size 116KB
          • SHA256 c6b6c1174c893b58b9166d696c2c6b47fbcfc7623a6062694982113e67bda12a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spotube.exe
          • Path C:\Program Files\Spotube\spotube.exe
          • Size 263KB
          • SHA256 72c4e3316de8f6ff40a4d8ad6172c904bebc70ee71a61fc0528a4d954da23f3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sqlite3_flutter_libs_plugin.dll
          • Path C:\Program Files\Spotube\sqlite3_flutter_libs_plugin.dll
          • Size 9KB
          • SHA256 3f2169f32e11cabbc48256a1280c3b4d6c53a5ee8f38f9c64a4a5d0e9a644d9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tray_manager_plugin.dll
          • Path C:\Program Files\Spotube\tray_manager_plugin.dll
          • Size 104KB
          • SHA256 75acdc2aab56448a1ed09f8b9f193c194c073b7e088de6b5ed4426b8b97618d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          url_launcher_windows_plugin.dll
          • Path C:\Program Files\Spotube\url_launcher_windows_plugin.dll
          • Size 96KB
          • SHA256 ec9664e1bd9a98adb275aadc2072e3e9f6237eca40d93b4e6b3f0ee4865fe773
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          window_manager_plugin.dll
          • Path C:\Program Files\Spotube\window_manager_plugin.dll
          • Size 127KB
          • SHA256 29de02bcfb8a458845c81da1f9abafe02abe2caab744b82c63f40c9336f368c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
          • Size 986B
          • SHA256 9de40acc3c421655f5b7b417a10a08d30f846d9d3b66b64f4f310a96569df8da
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260727165350_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260727165350_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 a84da5f05fd0cc6edf7dde545fcb1a82a0bff2d77956b28716a583f1189d0075
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260727165350_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260727165350_001_vcRuntimeAdditional_x64.log
          • Size 2KB
          • SHA256 ac85c7f79c1fa4ad635c979c2bbb19d4f280df01fd2c066b84d4431ada08704e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Spotube-windows-x86_64-setup.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-21FFH54RLZ.tmp\Spotube-windows-x86_64-setup.tmp
          • Size 4.2MB
          • SHA256 eddc8fc43fd99b209d08ec8200de806c6dbc6b6d18217380d71f0140b98f7717
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcredist2022_x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-O5RG2ELS6A.tmp\vcredist2022_x64.exe
          • Size 17.9MB
          • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Users\Admin\AppData\Roaming\oss.krtirtho\spotube\metadata-plugins\Kingkor Roy Tirtho-Musicbrainz and Listenbrainz-1.0.0\logo.png
          • Size 73KB
          • SHA256 90522cfd4b8714daef664e96bf06e1ba8587fe648a3806fe4190dd96f0678b9e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          plugin.out
          • Path C:\Users\Admin\AppData\Roaming\oss.krtirtho\spotube\metadata-plugins\Kingkor Roy Tirtho-Musicbrainz and Listenbrainz-1.0.0\plugin.out
          • Size 67KB
          • SHA256 23dfae30350842c1b6f60da4ccea096e4c1e2dd0fb22063ef324dc55ba9fa9a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Users\Admin\AppData\Roaming\oss.krtirtho\spotube\metadata-plugins\Kingkor Roy Tirtho-YouTube Audio-1.0.0\logo.png
          • Size 18KB
          • SHA256 274cb8cfe9366e2327218123abc12c1f4e4d23e5eafb33bf13073af0df2c044c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140.dll
          • Path C:\Windows\SYSTEM32\MSVCP140.dll
          • Size 628KB
          • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcredist2022_x64.exe
          • Path C:\Windows\Temp\{08D54FC4-BA34-45D1-AEFB-1E7DCE48804D}\.cr\vcredist2022_x64.exe
          • Size 615KB
          • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{17D45FC9-4BC4-4920-B289-AC6D0DE64C74}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{17D45FC9-4BC4-4920-B289-AC6D0DE64C74}\cab5046A8AB272BF37297BB7928664C9503
          • Size 1.0MB
          • SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{17D45FC9-4BC4-4920-B289-AC6D0DE64C74}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{17D45FC9-4BC4-4920-B289-AC6D0DE64C74}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{526CC762-8EF2-4010-B2EB-F7A902861F2B}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{526CC762-8EF2-4010-B2EB-F7A902861F2B}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{91ACFFA2-933C-42DA-92A3-A61516F95DCB}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BootstrapperApplicationData.xml
          • Path C:\Windows\Temp\{B4B09C9D-17E9-491D-8D79-9E3253EDE73F}\.ba\BootstrapperApplicationData.xml
          • Size 7KB
          • SHA256 0af0673e1f3ca87701e3c00d5ff004fccb00e2a983df1d72671c429cfef7f3c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{B4B09C9D-17E9-491D-8D79-9E3253EDE73F}\.ba\thm.wxl
          • Size 3KB
          • SHA256 21a76eb702fe727ca06de6632be2294ed1caa9e1d3798d01ed1428e0f40e19ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\Temp\{B4B09C9D-17E9-491D-8D79-9E3253EDE73F}\.ba\thm.xml
          • Size 8KB
          • SHA256 8d67851408a62b0f04dbaaddc588cd98499cf3630ec5df9f7c0699f0d367f79c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2532-272-0x00000000002D0000-0x0000000000347000-memory.dmp
          Download

          memory/3208-8-0x0000000000160000-0x0000000000249000-memory.dmp
          Download

          memory/3208-0-0x0000000000160000-0x0000000000249000-memory.dmp
          Download

          memory/3208-1379-0x0000000000160000-0x0000000000249000-memory.dmp
          Download

          memory/3440-1378-0x0000000000720000-0x0000000000B6B000-memory.dmp
          Download

          memory/3440-12-0x0000000000720000-0x0000000000B6B000-memory.dmp
          Download

          memory/3440-9-0x0000000000720000-0x0000000000B6B000-memory.dmp
          Download

          memory/3440-10-0x00000000011B0000-0x00000000011B1000-memory.dmp
          Download

          memory/3440-71-0x0000000000720000-0x0000000000B6B000-memory.dmp
          Download

          memory/3440-6-0x00000000011B0000-0x00000000011B1000-memory.dmp
          Download

          memory/3440-335-0x0000000000720000-0x0000000000B6B000-memory.dmp
          Download

          memory/3440-153-0x0000000000720000-0x0000000000B6B000-memory.dmp
          Download

          memory/3440-66-0x0000000000720000-0x0000000000B6B000-memory.dmp
          Download

          memory/3440-68-0x0000000000720000-0x0000000000B6B000-memory.dmp
          Download

          memory/3440-1377-0x0000000000720000-0x0000000000B6B000-memory.dmp
          Download

          memory/4268-273-0x00000000002D0000-0x0000000000347000-memory.dmp
          Download

          memory/4340-1372-0x0000019E57150000-0x0000019E58181000-memory.dmp
          Download

          memory/4340-1371-0x0000019E57150000-0x0000019E58181000-memory.dmp
          Download

          memory/4340-1370-0x0000019E57150000-0x0000019E58181000-memory.dmp
          Download

          memory/4340-1373-0x0000019E545A0000-0x0000019E545A1000-memory.dmp
          Download

          memory/4340-1369-0x0000019E54590000-0x0000019E54591000-memory.dmp
          Download

          memory/5608-270-0x00000000002D0000-0x0000000000347000-memory.dmp
          Download