ca0ffc6e0f4e2c9b4c303a36380d0ed427f8953dcd17e43608ccc0390508c023

Analysis

user interaction
yes
max time kernel
76s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpotifySetup.exe
Size 1.2MB
Sample260620-ev6w7set51
SHA256 ca0ffc6e0f4e2c9b4c303a36380d0ed427f8953dcd17e43608ccc0390508c023
MD5 39d38a57fe7afedb3f134e79a3aab4b5
SHA1 8f4727cbe3d5c979ded614b56b3d08aa34902338
SHA512 5101bc131d22c31ae4fe4db8cf3e1e9b75fffc374baa79d3cfcbf5dd0b94c7c09f5269ca96232ae684941fe189e9df62ee8b95f0457d6226ddb152b0a9cb149b
SSDEEP 12288:b1hE8IcIrzEP48eZx5PpQsM4F5nLYU8ygnAgoe540B7DTSFi14jH:b128nIrIP48i5PpQJ4FNLYc46H
TLSH
T1BB555C895B28D6AEE363D17D4021D139E6717C220FD1924A42F9A2FC1E7B334796BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery persistence privilege_escalation spyware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --autostart --minimized"	Spotify.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	4632	SpotifySetup.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Spotify.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 9 IoCs

pid	Process
4192	SpWebInst0.exe
3904	Spotify.exe
1736	Spotify.exe
3900	Spotify.exe
2604	Spotify.exe
5936	Spotify.exe
3488	Spotify.exe
2448	Spotify.exe
5024	Spotify.exe

Loads dropped DLL 27 IoCs

pid	Process
3904	Spotify.exe
1736	Spotify.exe
3904	Spotify.exe
3904	Spotify.exe
3904	Spotify.exe
3900	Spotify.exe
3900	Spotify.exe
2604	Spotify.exe
3900	Spotify.exe
3900	Spotify.exe
3900	Spotify.exe
3900	Spotify.exe
5936	Spotify.exe
5936	Spotify.exe
5936	Spotify.exe
3900	Spotify.exe
2604	Spotify.exe
3488	Spotify.exe
3488	Spotify.exe
3488	Spotify.exe
2604	Spotify.exe
2604	Spotify.exe
2448	Spotify.exe
5024	Spotify.exe
2448	Spotify.exe
2448	Spotify.exe
2448	Spotify.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2604	Spotify.exe
1820	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Spotify.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Spotify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Spotify.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264026411401885"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\AppUserModelId\Spotify.desktop.client\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\AppUserModelId\Spotify.desktop.launcher	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\AppUserModelId\Spotify.desktop.client\DisplayName = "Spotify"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\AppUserModelId\Spotify.desktop.launcher\DisplayName = "Spotify Launcher"	SpWebInst0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\AppUserModelId\Spotify.desktop.launcher\CustomActivator = "{18A68F64-72DD-42CE-A75D-EDBDAC226F5D}"	SpWebInst0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\AppUserModelId\Spotify.desktop.client	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\AppUserModelId\Spotify.desktop.client\CustomActivator = "{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}"	SpWebInst0.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\AppUserModelId	SpWebInst0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{5F86DC52-D653-4CFF-BAC7-C3A406AF8946}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" -ToastActivated"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\AppUserModelId\Spotify.desktop.launcher\IconUri = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\toast_icon.png"	SpWebInst0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4804	chrome.exe
4804	chrome.exe
3904	Spotify.exe
3904	Spotify.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe
Token: SeShutdownPrivilege	4804	chrome.exe
Token: SeCreatePagefilePrivilege	4804	chrome.exe
Token: SeShutdownPrivilege	3904	Spotify.exe
Token: SeCreatePagefilePrivilege	3904	Spotify.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
3904	Spotify.exe
3904	Spotify.exe
3904	Spotify.exe
3904	Spotify.exe
3904	Spotify.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
3904	Spotify.exe
3904	Spotify.exe
3904	Spotify.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe
4804	chrome.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4192	4632	SpotifySetup.exe	92
PID 4804 wrote to memory of 2940	4804	chrome.exe	102
PID 4804 wrote to memory of 5244	4804	chrome.exe	103
PID 4804 wrote to memory of 1820	4804	chrome.exe	104
PID 4804 wrote to memory of 5244	4804	chrome.exe	103
PID 4804 wrote to memory of 872	4804	chrome.exe	105
PID 4804 wrote to memory of 872	4804	chrome.exe	105
PID 4804 wrote to memory of 1188	4804	chrome.exe	106
PID 4804 wrote to memory of 1188	4804	chrome.exe	106
PID 4804 wrote to memory of 868	4804	chrome.exe	107
PID 4804 wrote to memory of 868	4804	chrome.exe	107
PID 4804 wrote to memory of 4476	4804	chrome.exe	109
PID 4804 wrote to memory of 4476	4804	chrome.exe	109
PID 4192 wrote to memory of 3904	4192	SpWebInst0.exe	110
PID 3904 wrote to memory of 1736	3904	Spotify.exe	111
PID 4804 wrote to memory of 4384	4804	chrome.exe	112
PID 4804 wrote to memory of 4384	4804	chrome.exe	112
PID 4804 wrote to memory of 3844	4804	chrome.exe	115
PID 4804 wrote to memory of 3844	4804	chrome.exe	115
PID 4804 wrote to memory of 788	4804	chrome.exe	116
PID 4804 wrote to memory of 788	4804	chrome.exe	116
PID 4804 wrote to memory of 4840	4804	chrome.exe	117
PID 3904 wrote to memory of 3900	3904	Spotify.exe	118
PID 3904 wrote to memory of 2604	3904	Spotify.exe	119
PID 3904 wrote to memory of 3900	3904	Spotify.exe	118
PID 3904 wrote to memory of 5936	3904	Spotify.exe	120
PID 3904 wrote to memory of 5936	3904	Spotify.exe	120
PID 3904 wrote to memory of 3488	3904	Spotify.exe	124
PID 3904 wrote to memory of 3488	3904	Spotify.exe	124
PID 2448 wrote to memory of 5024	2448	Spotify.exe	130
PID 4804 wrote to memory of 5928	4804	chrome.exe	133
PID 4804 wrote to memory of 5208	4804	chrome.exe	134
PID 4804 wrote to memory of 2140	4804	chrome.exe	135
PID 4804 wrote to memory of 5496	4804	chrome.exe	136
PID 4804 wrote to memory of 5496	4804	chrome.exe	136
PID 4804 wrote to memory of 2704	4804	chrome.exe	137
PID 4804 wrote to memory of 2704	4804	chrome.exe	137
PID 4804 wrote to memory of 5612	4804	chrome.exe	138
PID 4804 wrote to memory of 5612	4804	chrome.exe	138
PID 4804 wrote to memory of 2496	4804	chrome.exe	139
PID 4804 wrote to memory of 2496	4804	chrome.exe	139
PID 4804 wrote to memory of 3112	4804	chrome.exe	140
PID 4804 wrote to memory of 3112	4804	chrome.exe	140
PID 4804 wrote to memory of 3284	4804	chrome.exe	141
PID 4804 wrote to memory of 3284	4804	chrome.exe	141
PID 4804 wrote to memory of 3004	4804	chrome.exe	143
PID 4804 wrote to memory of 3004	4804	chrome.exe	143
PID 4804 wrote to memory of 5872	4804	chrome.exe	144
PID 4804 wrote to memory of 5872	4804	chrome.exe	144

C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe
"C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe /INSTALLCOMPLETE
    3⤵
    - Adds Run key to start application
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.92.148 --initial-client-data=0x220,0x224,0x228,0x1bc,0x22c,0x7ffa8c595448,0x7ffa8c595454,0x7ffa8c595460
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1736
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.92.148" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2200,i,12341488100576525090,3192776339777161304,262144 --field-trial-handle=2440,i,4816223486960600692,12219785521776160815,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2444,i,14008653562043387633,16991279890419069567,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2448 --mojo-platform-channel-handle=2436 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3900
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.92.148" --metrics-shmem-handle=2592,i,14511251428782204873,14580787525434548804,524288 --field-trial-handle=2440,i,4816223486960600692,12219785521776160815,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2444,i,14008653562043387633,16991279890419069567,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2632 --mojo-platform-channel-handle=2628 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Time Discovery
      PID:2604
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.92.148" --metrics-shmem-handle=2916,i,9845023531824493279,16458475064714162228,524288 --field-trial-handle=2440,i,4816223486960600692,12219785521776160815,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2444,i,14008653562043387633,16991279890419069567,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=2932 --mojo-platform-channel-handle=2928 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5936
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.92.148" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=5888,i,9397467045445011716,5137176258639300084,2097152 --field-trial-handle=2440,i,4816223486960600692,12219785521776160815,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2444,i,14008653562043387633,16991279890419069567,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=5936 --mojo-platform-channel-handle=5932 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa9f80c728,0x7ffa9f80c734,0x7ffa9f80c740
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,9640892579318037821,13683011213730195643,262144 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,5437637879243282203,6015756353582317315,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,2629933546277186043,10163967634559510418,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,7093990077550859213,11875349223147422475,2097152 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,4766132416344444630,15132781288880598558,2097152 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,13860716609711770340,7428727237867562176,2097152 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4448 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,8530049889010499055,4058272162291341340,2097152 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,8169619641395051515,11412848273668901272,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4408 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,16594589292589702272,3654396012636854371,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,5942215249319949656,8055762365522337559,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,2945997953060771551,12504371814016111160,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,16565319677460959919,9962565792937593839,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,3226000270711475320,5057725439055339750,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4540,i,677068038885141519,13413278399411091241,2097152 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5724,i,10210724550956546970,2403126999507134021,2097152 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4928,i,16826954111761281843,10503897123512861110,2097152 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6104,i,10099385304370282705,1742934119315230332,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3312,i,3759335188844302970,2392539940959476191,2097152 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3328,i,3771113813455622103,6056347823162755284,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,12630132816536675860,9760893788548331836,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6272,i,2719060777676046981,16250756681171432362,524288 --field-trial-handle=2060,i,3442494664053546533,615548541129471996,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:5872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5900

C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.92.148 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffa8c595448,0x7ffa8c595454,0x7ffa8c595460
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e2e18ba6a7ecfa7d6ae4b53361e0d0e8c4ee0db4b65d89c73df77a0a90062723
MD5 42cbde8e544f7a673649c37abe4b3a9e
SHA1 b343005536762e08ac7c2e878901fe063d353392
SHA512 cd3fe7e19db631b1370db33d7810697b0d76134a88a6deff6d0421e790ee07d3314e7bbd2b556d24156280e8e698b0c8807f7b562e741cb541e50103b1b8879f
TLSH
T1E5E02BABC961EC371CFD0B1D60501745E654230B3B40458F3A3C85088FB563B4B86C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a0dd5d5279de65599ce2fc8d0c53c076a8ac5a46eb4c0f691d83de281da8a0fa
MD5 76d7ef31167de0b6aa8f2489111a7ebb
SHA1 8158900ea86a2f487b42f989d75f857f99b53527
SHA512 1886e50a972f9a39e5672f4c776ea46da4494ab9479e05993efa077904858667baf8c3ae4f27484f2614c92f29a0d31478c17b2106dd9b6ba0923beaac990e4d
TLSH
T14E4159F7D7D886BE890196F8B6152E2FCE2D0E54532C3C5AC8D4AE0F57E2972D24058E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4116add583bd579e048f6de7489009a1d5bbc5a9335eef96a04d75514c63a460
MD5 dbce51d5715bac1287dcd92f33a0c011
SHA1 709306a871e0e976c574f529629bf1d343e7b348
SHA512 dabe1871d946659c6b52b7b0df0fd375037ffc8623b6c3ee516e52eadf9fd74de896ceaf1853d068bc56b6f876b9949314df549d37b1ae71dd1ccfc61cb01156
SSDEEP 192:rRTVPC77GBv71hhAPRp2g92Hsb+WNnSedJ20okwIalGVyIsnAUgraJ:rRTVRRBh8XDQw3dOoalee
TLSH
T19A42C43EA920657BADDBD22AFE527723D7F5202221E51E84E7FC8A1C05D75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2d0b5cae6f919ebceb0182cdb6288fc5b83a90e7e144f430ea6678325f7a2130
MD5 1a6735f174f102468f99be585d0e2452
SHA1 f1bb5c394515c39c7e94b9d73aea02513013e358
SHA512 e87cc1eb4ffb85ddb6c62d503847642c442e619a22b57a98bcf8339f583e3211916b6736e86f86d0eb466313deda8b2b63387d4346c8e7d24356119516ac38b6
SSDEEP 192:5RTVPC77h3Ev71hMAPRp23q92Hsb+WNn2tIgFt2l20okwIalGVyIsnAUgraJ:5RTVagBhtXDQw2I42yoalee
TLSH
T1F252C53FA920657BADDBD22AFD527723D3F5202222E51E84A7FC8A1C05D75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 18a940f587c0ced99895d8624ef689b96e79035026b26c9b047712fea1a14a47
MD5 e61796106c5aa8be391d576a219bda9d
SHA1 6d57c9565f1c1b00c770ec8ac8ab9d69fd4b4fbd
SHA512 c5c1307d226e33da64678a098a2ddeeffe49596dc86f0ff6d9f5a012e40305bc979b7fc25d21c7e830f4f015a258dac6719bd178da68304401fd20c13e0a4868
SSDEEP 192:rRTVPC77pBv71hhAPRp2g92Hsb+WNnSedT20okwIalRVyIsnAUgtaJ:rRTV4RBh8XDQw3d0oal38
TLSH
T1B642B32EA920657BADDAD22AFE527723D7F5202121E52E84E7FC8A1C05D75CC222741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 afcf322d8aaba67c473bee8f5a6cc882982234361ef957a887c6c81ef479b94b
MD5 1f91fd3d52d9174278931128d46210a1
SHA1 05d2e8f603a30939117c5e360eb78c8ecf5ae250
SHA512 9e319b1b373d406f691bc7a30d2714b5bded2eed15dad68b681c478c0cdeda0f66c7bf367fbd7856f0e718883867f9c591ae9baeae5aad97fd2d0b05eb51c954
SSDEEP 192:rRTVPC77pBv71hpAPRp2g92Hsb+WNnSedT20okwIalRVyIsnAUgtaJ:rRTV4RBhUXDQw3d0oal38
TLSH
T16242B33EA920657BADDAD22AFE527723D7F5202121E52E84E7FC8A1C05D75CC222741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 1768ea081f65b6ef392d22f86cc96e47967a1f2b04440a971c8b9d7da72ef24a
MD5 28a2100297a5f4d9990a02ffb8736f5b
SHA1 276fd2263a467a2690d8c244762d648b7bdfa400
SHA512 f2e68582458b009ff79676f95cafea30b49e7ac77afc5cefd74d83f0dc6186f13db178fc7c99164906cc47204e5e7c36aa9d53dd3f23fefcddff974d7e6938cc
TLSH
T1A6C01246D0077502E29E0BBA294BE8D871185F30E60A234E87F01D62DC751318116161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d48dead7f5a5b72ccac6e48db60282569d1f2e659117a49344727ee0d3eaaeea
MD5 748a2cbc2247d7d33a8b85202f18dd2e
SHA1 dd3ea805e24e297fe0de51a32bc9a9ad5e66e66c
SHA512 2907ce6e39e302a3bee0d41594ef60172651b1b37e00b0205acddd4fa07ccb5bae04c6fd8779be2b611cfa9275f8bcd15596b3d4f1b70553376f030135c53119
TLSH
T114B0125084419101C08302B015835888F1545F54970A270643F16932C8251A28124050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f865.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f865.TMP
Size 96B
SHA256 3af3d60eadcf5e0208ef2a664485c36de4b226557a1124ff4d2cdeb6fbbf2674
MD5 aae085d0436617cd4ecc1866be193180
SHA1 f97f4b66f07fdb3afdaf65d4727a754f6bbb9da5
SHA512 c030a106830cc9bba6cc49167992c899410a14e1a29258f10ecc85804963bfc178ea9ac645730cd8630308139044af3ea736b7a6d44c62fc31827bc2eabe5357
TLSH
T1BBB00257C962B212C15343B02AA699DD71B1DF35D703121292E91E67DC37671893B5A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 f3df181a7c043e0eb182a4a855db4e552b7d61723e39e2ba35e3af634c45ecbb
MD5 d5ed829bbc7c93a1a7824088e66c23f8
SHA1 883d6aadfc0c8890c7ed3226f434d1a707b0271f
SHA512 c12ff7ec73b32ea0bd46ace38f72947a9107fbf676ee971318db7a00fd4fae2adc6f192a82756ebdb74839b17d45732e8681666e37e00d550e5225a346938af2
SSDEEP 6144:UpsLiqC6IPHXi0X6vK+1Am7Rkm1tYpBeh2BAoZ:UpsNC6cHy0IFz9oBGcAoZ
TLSH
T1FF341227AD7ADEB715A8A718B08F0B1F0CF449A3D470D997C4F56F00639AAC9444EE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5d78368b86296519c858de53415a4ece7296bc9866fe2fa14de49754bb17d825
MD5 72973d12a1006c93ef66e3252ac3f6a3
SHA1 bdebdd1fdc50a05679018f7540e0eb1e25c5d293
SHA512 3815babb311b8330590a8830f6508e3ab78df0b81073a2223ea46209b0604361d8f49e042de7e0f3c5f5f386e3d0577fa04453db155531a2af1968a59414a043
SSDEEP 3072:cGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:vm7Rkm1tYpBeh2BAo3
TLSH
T10AC312275E71A9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 57b7338279c72f781e9f4d8df83d9b6d13c1a1e4adf4caf6ab24599abcf7e125
MD5 310759ead62409b55b53201661b94e03
SHA1 4d352a5d1b0868346ce6b56ab7703cbed17ba766
SHA512 bf5097d19a11040ceff988d75cc0239d8c7100df139979cb782e250fe7fd74a8ef434243d4aa10e7f1227991ad4fb7516f2919c04f553556a935bc7057efff72
SSDEEP 3072:gHGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:1m7Rkm1tYpBeh2BAo+
TLSH
T17CC312375DB5A9375CB9B75EB08E0B1F1EF149A7C920CE92C8D85B0423EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 13446ae6196ca189cd19c99522a2aee453009f426e015cd67e2420b7a242c09a
MD5 3dc773259184e794308b963c7fb4d7eb
SHA1 9fe94a8729057bc47776350bb56ebc0d4937f538
SHA512 daf44775e506c66002b5af0352919b27b658ea62edaf5504e764b9d1390d196d74886cdef9e79115fc564d852a1b9837aab97892901b811bb65f3b6b98e7d155
SSDEEP 6144:9psLiqC6IPHXi0X6vK+1Am7Rkm1tYpBeh2BAoZ:9psNC6cHy0IFz9oBGcAoZ
TLSH
T1FA341227AD7ADEB715A8A718B08F0B1F0CF449A3D470D997C4F56F00639AAC9444EE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a0d2a1270ae6e900031e65819a68c471da5beba78951c7481513c43abae33106
MD5 1baf0d2c53c22ca430f371fb236bd2e4
SHA1 cdfcd6f4b64ebbb05622dc62c7392080444b878c
SHA512 e96bd928a4771aafdb278b453caa5f7fd2e755fcb4fb1b59ccd6402d307478124434db1ec586abf7adae05b930ec9122736f31dd9caa719b32761d1c522d4d57
TLSH
T136A002B106516507E64023B478C1D645B335891903972B07E0F544F4C8753564102041
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59307c.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe59307c.TMP
Size 48B
SHA256 da6f4b0411da9c629db580934360a3673bb1999ab0ca56071591dc816a7a3413
MD5 6cb642acd4bb33345d4bf4b95558b600
SHA1 2d0a7a0a963494b690d6d4b23cef8d916610b8d8
SHA512 65ae87cb9fc355fff5354df72f26fae018e04af0d9ee87483e6e077e7411887ac51b928e051e6dfe88bb6768c6248e04e32711815ac7e57b5d00edee340a089b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
Size 10KB
SHA256 379bdc0652c14fad0f8b999a612ac46b2b4cfb00c7108401628f677830e41b58
MD5 fa71a581e008426a0d10433335f2e8a2
SHA1 9bfd4496abe1b630ca7f2fc9d8b95ee58c0ff341
SHA512 e73d34d53f8dc1c0cae9e5b8fb9d11883d3ea99f7221bf8c62918f1ec35aedc6a29a32d7428f5fb99d616e98e5bb20d13949ce17274ae13c2b11dea4164db9c7
SSDEEP 192:zRfwsZ2b4v7u2459XHcb+WNVN6N1dN+taYum/yIsn2KgR:zRp2AKJxg+gR
TLSH
T1EB22C56BA924657B9CCFE229F9657B52E3F5103131D06E88D7FC8A2C16D7ACC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5937df.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe5937df.TMP
Size 10KB
SHA256 ddcaa2d5736ac956e4c0b21eaffad906db49c156e189c37451c7d8c4e7c2bf05
MD5 65f55dc00d65650d7aaa7f215c308c15
SHA1 19879470cd2644e25f240a285623e1cce73c529e
SHA512 8539cbda5c8f384af2cf19d45f630695600f4b8cdac991aaacc0d5fa2311bc1b7244c93fef3f0098f6954ab0f5b7873c3df8bebf543be9df13028d05da8f34e7
SSDEEP 192:zRfwsZ2bEv7uV459XHcb+WNVN6N1dN+Tg6um/yIsn2KgR:zRp2UKSxgeaR
TLSH
T18122B56BAA24647B9CCFE129F9657B52E3F5103135D06E88D7FC8A2C16D7ACC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Spotify\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

aec11dbf-c939-4b12-b414-260d3552cff0.tmp

Path C:\Users\Admin\AppData\Local\Spotify\Default\aec11dbf-c939-4b12-b414-260d3552cff0.tmp
Size 8KB
SHA256 7ea17ff174fae16b59ddab1ddfa18a44bc406437b82c40bb9c9017c62f42eb53
MD5 170a13b26bf65c283f72f210b758e112
SHA1 249d7c3c7b52c162febd96e56593dcc8e008665a
SHA512 53d08e7beff5b8ac5c7eb644a07305350c8e4c0b32f4cc28fb36ee062f3a1bb44d71c3d02398d05ddba8e4fa7a4faa155360910f66092d1495c3a9d85483c4c4
SSDEEP 192:zR5wleP3v7lI89DHcb+WNOSuG/yIsn2Kg8:zRSeXHlg+A8
TLSH
T1AE02962BAD24657F9CC6E269F9217B82E3F5102135943E48DBFCCA2C29D7ACC1227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 6KB
SHA256 c44e6d61476a918988fd22243c5d045889dcbd87e96714875d3a88493cf47b12
MD5 992f0b730cc6bcf3476ad0fdf3a7643b
SHA1 1dcb64d2a3e55fcd5f22f331afb83ba748e4e8f3
SHA512 56c9e73c5d066e20caaf2a6393ba0a9c2a255f1cea513d52a99c9be0b562d5796533e38c2733d03711574e78c60c9b698b32be00afc2ebd66dd0ff0849b5fb5c
SSDEEP 96:xMTbJ6JfKhbQg+Dotoh+DotoyN5P95DBwB6vpGyves0u968ZTZ/DGbQg9ZQRHlk5:ytTqDUxDUBfuBnM/mZoHlO
TLSH
T141D1A43AE587DA27ECFF94813221F686EB50121552845EC4ACFA4D0D83DF9FE720281E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Spotify\Local State
Size 3KB
SHA256 4b3d9debe0b3e8b2f0839b6c93a3b2101ccf90cfc2d6c283d6592fc17f936cfd
MD5 230b277de72e70102ecb12778ec65e14
SHA1 26ec0eced4c449786d483b8427a9613c9b9fec4f
SHA512 21071ddb43f0f00e89db2be797cb3cf2012e871e91c3e4422acbda16213bcc89a7bece832e434fc4d40bf5293da1f34f15b8be22b550bf9a194fa732d348a29f
TLSH
T1E96185322468AD7795FAE441B9823B03EB642113A2647FD8D5FE4B0C52F79EC1383527
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58f42f.TMP

Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe58f42f.TMP
Size 1008B
SHA256 1d01c52bb2e617823168b16d4774f968971bc5bc88585e8357934c13652550bf
MD5 a45bb506790045e0f55f4758c3e59116
SHA1 eeae206c85edae921206799c40e4586794fc87b1
SHA512 92fc5ed541ec720eca08eafa9676d94e0a75f8a5a8ac7e4c776f9485823d0f2a4c8127bb4c2a86885def5717b96f022bf8c0172e0df5dd61a5701706f7cd76b9
TLSH
T1DC1154B218403B72AED4646B66977B130F242161C1654F8D02EF431153F6DF81257D75
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
Size 56B
SHA256 5838b51930a2667d5f17efc1522c53496ad08a14cc4a1368673768f3df1bc4d8
MD5 6cefa35e5f5557e91feae32ab9821eb4
SHA1 aee1b62354467f1c73a8d6225316d528b3d7da73
SHA512 ae2d3ff2675bbd413847e1d089d825cb950759b6c8c60c8fed9ac8aa797d06c216cfb5d0618c7a09040d4766397f06da2b2c15dbccda3e7b6c8b8f1f8f2db9b1
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
Size 3.9MB
SHA256 92ff4e100aeb2f96650172ced71912c45815b4b081f301cdda3d6022a09f73b9
MD5 963f060716f39b66034d88db0f0a52fa
SHA1 b6945e5d2d39bd3e1e184132e39c00028f17e03e
SHA512 ffba60a980de70a914420d8d6470a6a4fb166862cadb02cb691ffb5950afd17c1af42ef868c5dc479d0f853c39de0611b60ee7b999599af14735119b4b487851
SSDEEP 98304:75Ce3TSse9K0GURonmicgOAbHBPXSJOE2ka9x1MFVBW:zjC9SPnFHBPcOE2b/Mg
TLSH
T117163338C3F51D05C6AE2E31D9E92F56E6A21DC30610FF55F9A552E71E0A1F2CAB1832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
Size 39.7MB
SHA256 7b44456a90142daeb758e2736d8628ffe211d6ea523db8f1050b3c8b1addb68a
MD5 105e81de9cbebf51e1859942564541e1
SHA1 9c8b3149267137cbc0ba554c71f95cdac1aaa3a4
SHA512 0817000669b24c0be5775f45ba32f8b0abd8facd4273af13adefec76a33a5401af6e1a03120977b5a7ac6f4589d47bfb3310b907fc92b237ac09c6bbca8f6b9e
SSDEEP 393216:kWsuanyT5oN2zN7nA7hz+widdng92ph46RwTJAKgSDr7OgSDr7L:55dAdDY2trPOrPL
TLSH
T1F8979DAA72E401ECC0AEE1BACA13DD1BE7B7744A0731E34F02E192621F67660567F751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spotify.exe

Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
Size 2.8MB
SHA256 b92b52483508e01ae3eb54eefb48e8ee00f87e87ecca557d8ea90d68d4b9302f
MD5 ed7f0f56969eefaf54481d2cce1280a5
SHA1 ac9c167826a9ef83ec40e86be3777366ef0f93a1
SHA512 0caa22d30c82dd66543637326a96a3ba584d4ed37a5807fbe5e6c840376dffed170c2ae934b9fba38ec400afdf5cb5629995790343c20803ad1b59a95aa32359
SSDEEP 49152:oHYTMT79ilVoOwsaZigGr9yAeARiTEYiyJjh8Xi6D3cEL8+diY:oHYg8xwfGrUA9Ncnas8jdN
TLSH
T1C5D57B13F29901D8C01DD178974A9232FA61BC454B35B6DF0B90B7622FBAEE46B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
Size 705KB
SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
MD5 0321d6c44a6041910208ce3891727842
SHA1 42e8935bd94f0fa3fd8611fc84e25a06e8ba82ed
SHA512 6c9348ed4d50fb2503012b80c0dc8f4cf07d00d2ff857fff8c102266533e65befc6535998f9497fe414cd427dfaf0ff3e5cd1b586addba236b3794768e3d476c
SSDEEP 12288:bI3H1fJwhjzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnSzm5dVYJblIt6kjKQCrC:U3VBE7zEEmPL8bTe+gnSzm5d2bc6kGQt
TLSH
T1FCE412E77374AC7DEE9B1277826505B0FC371A681B82020A179BF8796913B48D8C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
Size 1.2MB
SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
MD5 d995543b367f8675ba74b90f42790175
SHA1 ae7f07096d74d1565929fffbf1a9711a08fc74e1
SHA512 99018c2cd0685bcfc6de8d08a649515b606982f56f1dced3b5304c7358e74bb463aa89795752580abff98b288865b49720940f8f0707a5f2527457edda968685
SSDEEP 24576:i3zB09p2zLmmibkFR8+mZi5r8BWhQumeMRvQt93dyQwuSXAkpbaUGQ74:i3y23mNbkFRJmQ58khQRT1QPtauSXAkA
TLSH
T19E4522D7A370DC7DDD530BB7929B40F4FD7A106B0AB2140A0627BD7A39257889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
Size 2.4MB
SHA256 55c6cbccc7e2f9b6be24fcb3cf0e960bab2d84d605fc2d9e2bee0c7df748b37d
MD5 6f41babf2e50b00fb3736c483d062dd2
SHA1 a8992a79d8d8cf680fcc70c7ebbcba8f82a8c0c5
SHA512 9c9046b1fac1ac8cc269bdb90decd339123e141a8bb94b125c8153b73a3f5bc14ec6d7e25985f9a80d8951250142bd774b7c0e248a3849ffd3ca7851df11595b
SSDEEP 49152:JLOG2qDuB7RIo63ZBZY9iSD2kT2McYcNy5l1K:JqG2qe6JBKDtXmKjK
TLSH
T1ABC56B13F2D901E8C05DD1788B5B9632EAA1BC460B35B6EF0A9077561E7AFE4673D320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crash_reporter.cfg

Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
Size 632B
SHA256 72ad691a13e317742338d8ba659557fc43985f5238af9b5ab9eba03e6e96cd42
MD5 4d03ebdb93285ad91bddbb2d2f1c2fac
SHA1 70b89663f7c6812e276102dee7ce4d1c37daed72
SHA512 dc007b46dc7c1a5f9c0bf34a74f23563d1d2e3167b88b5bf8fa6b4a0889a7ae1a954ffb121fe50bcc827d3a412e469b130e7144ddfb1bb876a349140324969ec
TLSH
T1AFF02DFF59D0757990F10BA1D03C63107CB305951B2B805846531F993B48F6DCA5DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
Size 4.5MB
SHA256 c33e55acebb06d9a7c6fe1d18d24a3db061f61d912eef06be93810f7712d9d4f
MD5 59dd92b8cc2d7c22f57f74e8e3a2f47e
SHA1 64110fb607614edacc71dcd8af93d97edaa6cdff
SHA512 ee4b5752b492498d4483e8eb886699123fd9e253d1317877b3e3599a27fb128a999a273cbcd57c6712219907b4ce9d5db765fb9e794fd43d943c6a76268cdc8f
SSDEEP 49152:NSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqp:QuktcrfNlTyj5byqSi
TLSH
T151268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
Size 504KB
SHA256 ef925b3111c06c63554dc7468424a9214b51777d04c37e0285a56a4f30702bd1
MD5 6c21dfaa7a5add2aab6c85d3c1d40e89
SHA1 088718cab149645ccea64647c78beb181a005fa2
SHA512 219cab4860ace4957a73816cd91936c9160e62adb27c5180491412aad2eb8446865c7185339e1e20f63d75dadc909d4a78215b7730eb5db0f48611adcd1eb6c4
SSDEEP 6144:yF1o4DAf5s1KStUkNbhk7Ak7KhPCcgoF0NKzdgbsQr7rVGCXoxU:61o405CtUkBZk7K9CcgG0NWd/QDVGtU
TLSH
T147B48E15B3E94AACE07AC134CA438547EB7178460B61F6DF02E0A2792F77BE45B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
Size 7.5MB
SHA256 25bcd423a399c6e620312cbc950a0e5efdfe124a66aa7c57ecb2ffe4ab370dc0
MD5 069be7243f25a04dd208ee09d833b416
SHA1 6ccf0e847505fbff6323aa7fdacae20051d15d7e
SHA512 6871af98d30f80db41e4f6cc243ded08a548542beae732717fb4d587f71b37dc6cdd577f46cd31ea5120a23cdf825b3301f8314ca632d8ae3b74232aedf166d0
SSDEEP 49152:+tvLjzlN4kFextqcusm4nHcpOjwrMQOT6n1SSCOQESgswJYgZc+5GTSpWy4EWT5t:oWusNpjgKle2S+E8Nkpp0ve9fPzF2
TLSH
T11C867C13F69240DDC01DE2B8975B9223F778B8450764B2CF2A5453162FBAFE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
Size 577KB
SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
MD5 2a1964ff31c7edff17f4c74d26fce378
SHA1 2c66f52ac23828ec6a18a6720ebfcb275482edcb
SHA512 fbb19f906ab8f61461c8be80d53a7cadddfe81524918171c0bfab45f9cec2f5c045ff7ff864858f5c087d4b05c585ba58dfdb7565302605efc524f388c241ba0
SSDEEP 6144:WpcHQYHQbmpKwey1WMmHfYOMg/jSxMP9sQqblfaYQhp1BPOjnng98//gwb:wwQKAGMDHfdgM6Qqbgaj+wb
TLSH
T117C42B1FF744122A05A352A27F099562FF32D06CA35112663CBD812C3376B6693BB7F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
Size 16KB
SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
MD5 8ce43bf0bee69290545738ae472bd5dd
SHA1 bbc36343250fa8bb2122c8af9e021fc80c032a0b
SHA512 67825fdb6c0381b7e35c73221caf37374157c1333388d0d20685f4d732340f7fc04faba29ae266fcaa921fff2694b5f8ca0ba24fbbdce2146189924e354df7a5
SSDEEP 384:5rg5RkIUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/neqA9oz+EFRUeLq4+lLbK74Tdu/:kgOXqEXqP
TLSH
T1DC72B89F1B21CA38E637477F6A5E3125EB3B805C4F91953419BBA44823C639603F71A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-Hant.mo

Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
Size 16KB
SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
MD5 d41d181d619aef4a1af14bcd6ad2fc1c
SHA1 05ea268a59c887a92387a2ad2925285901bba1ba
SHA512 b2ed7c0c97672411266ef55cfed4e98a7d812e85a20706140c8ea8c566677ed9bdcfaac7d0656496e34db5a7a50e0c9e810fe9a18c2039630745ce617513b605
SSDEEP 384:pFTaUhYqA9oz+EFRUeLq4+lLbK7wc+Qp/na5k+0SyIqLvsZXPuD:LxOXq+LBDXPuD
TLSH
T15E72175B1932CE38D5378B7E5B9F3624E63B612C5ED164342BEFB41423C636A16E2053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
Size 17.8MB
SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
MD5 c6c9a3d440e436b8c28867f3c3955ce9
SHA1 208847cb98181e6ba434dd5ec17d686824604946
SHA512 2e1d53d773f57cf8c311674d60615602670d44af7a7545c60172ebbd47d6bb32e382c4cc91a5394fc1a51dab4b654be822f81f1ea963ec1176624b0bea6a6f1a
SSDEEP 393216:pqX9UazcYdpnzyXm++SSSCZMwh56qAgbITfTK3l76TmkrqjFWBm0iw+X:pqtJzcYnzoN+wCW4AAITG3lVkMgmeI
TLSH
T10A17124BA758562BCE3F07B74652563F373091197F835307209283281C6A7FBAD8DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
Size 17.0MB
SHA256 9ab8604815dcad2dc1ddc46a70c87837e09e959316693e81d455129ab6a08f65
MD5 0df722c3ee966404cebe314dbb9b5751
SHA1 5a07085874487470c17fec4649d5f05079024583
SHA512 da0dacdd72de16b6db3e5ba179b2def48e20c1ce366ef260290f9f161ddc01a0d2e3f943a2ad896d3200c5f1ceb57d8db17ac3f3625fe653c13c2ee7d60c3f4d
SSDEEP 49152:hvUKHhuxVdVsl02n6UQWEndOiKtc0mQztzOPq5R8tWk1Kq:VyN
TLSH
T1A3073780E7F95348F2F77F65EEBA90564836BE96ED29C75E0405050E0831A4C99BAF33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
Size 5.2MB
SHA256 e1d1c7d1fb060985ddb75dac956a08b44642b51159829c6569fb6d2fbdea2fa3
MD5 06febf538d9310f9fd5dd34867577e4f
SHA1 c5f028c189755150dafdaf70324828c272cc425f
SHA512 8fbe3620a4ae9dfe369a94216e7db9b8ee430856e831a5b7e386f6dbc8d3e43890d806da027ef4c8c7b559cdaf8456f8ba37f3111af989213aafa961fe725f27
SSDEEP 98304:m4ydZOjlb3GaE1COMOIFGOOOOOOOOOOOOqLOOOOOOOOOOh:FlC09GOOOOOOOOOOOOqLOOOOOOOOOOh
TLSH
T166463803F19680E9C06DD579875EA623B632F8840B3676DF66A00F1A2E79FE0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3488-707-0x000001F38CFE0000-0x000001F38D010000-memory.dmp

Download

memory/3904-352-0x00007FFA89B30000-0x00007FFA8C325000-memory.dmp

Download

memory/3904-357-0x00007FFA89B30000-0x00007FFA8C325000-memory.dmp

Download

memory/3904-732-0x00007FFA89B30000-0x00007FFA8C325000-memory.dmp

Download

memory/3904-727-0x00007FFA89B30000-0x00007FFA8C325000-memory.dmp

Download

memory/5936-706-0x00000168B2570000-0x00000168B25A0000-memory.dmp

Download

memory/5936-448-0x00007FFABBED0000-0x00007FFABBED1000-memory.dmp

Download

memory/5936-447-0x00007FFABAEB0000-0x00007FFABAEB1000-memory.dmp

Download