Overview

overview

8

Static

static

1

SpotX-main...el.svg

windows11-ltsc_2024-x64

3

SpotX-main...ty.svg

windows11-ltsc_2024-x64

8

SpotX-main...ux.svg

windows11-ltsc_2024-x64

3

SpotX-main...aq.svg

windows11-ltsc_2024-x64

8

SpotX-main...me.bat

windows11-ltsc_2024-x64

8

SpotX-main...me.bat

windows11-ltsc_2024-x64

8

SpotX-main...ll.bat

windows11-ltsc_2024-x64

1

SpotX-main...ock.js

windows11-ltsc_2024-x64

3

SpotX-main/run.ps1

windows11-ltsc_2024-x64

8

SpotX-main...to.bat

windows11-ltsc_2024-x64

8

SpotX-main...em.bat

windows11-ltsc_2024-x64

8

SpotX-main...bn.ps1

windows11-ltsc_2024-x64

3

SpotX-main...cs.ps1

windows11-ltsc_2024-x64

8

SpotX-main...de.ps1

windows11-ltsc_2024-x64

8

SpotX-main...el.ps1

windows11-ltsc_2024-x64

3

SpotX-main...en.ps1

windows11-ltsc_2024-x64

3

SpotX-main...es.ps1

windows11-ltsc_2024-x64

8

SpotX-main...fa.ps1

windows11-ltsc_2024-x64

3

SpotX-main...fi.ps1

windows11-ltsc_2024-x64

3

SpotX-main...il.ps1

windows11-ltsc_2024-x64

3

SpotX-main...fr.ps1

windows11-ltsc_2024-x64

8

SpotX-main...hi.ps1

windows11-ltsc_2024-x64

3

SpotX-main...hu.ps1

windows11-ltsc_2024-x64

3

SpotX-main...id.ps1

windows11-ltsc_2024-x64

3

SpotX-main...it.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ja.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ka.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ko.ps1

windows11-ltsc_2024-x64

8

SpotX-main...lv.ps1

windows11-ltsc_2024-x64

3

SpotX-main...pl.ps1

windows11-ltsc_2024-x64

3

SpotX-main...pt.ps1

windows11-ltsc_2024-x64

8

SpotX-main...ro.ps1

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    894s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 02:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SpotX-main/scripts/Install_Auto.bat
  • Size 740B
  • Sample260715-chjvsshv9p
  • SHA256 43a0318d6069ca13bbe7d6a8fb28cf071229953ec21266cfe4940dd5af02699d
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwarediscoveryexecutionpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 39 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 5 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 53 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpotX-main\scripts\Install_Auto.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3984
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-confirm_uninstall_ms_spoti -confirm_spoti_recomended_over -podcasts_off -block_update_on -start_spoti -new_theme -adsections_off -lyrics_stat spotify'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/spotx-official.github.io/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/run.ps1' })} $p """" | iex
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3372
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" -V
        3⤵
          PID:1440
        • C:\Windows\system32\curl.exe
          "C:\Windows\system32\curl.exe" --help all
          3⤵
            PID:4872
          • C:\Windows\system32\curl.exe
            "C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.94-x64.exe
            3⤵
              PID:2848
            • C:\Windows\system32\curl.exe
              "C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.94-x64.exe
              3⤵
                PID:4540
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe
                3⤵
                  PID:1308
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\py21myoe\py21myoe.cmdline"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1036
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6301.tmp" "c:\Users\Admin\AppData\Local\Temp\py21myoe\CSC544644FA25894BB1922CAA82273CAB89.TMP"
                    4⤵
                      PID:292
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Drops file in Windows directory
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:4212
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.94.582 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7fffb1275448,0x7fffb1275454,0x7fffb1275460
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:5404
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=2064,i,17091977200918836576,5276118170520748819,524288 --field-trial-handle=1524,i,1478150681205649172,8379240989781992314,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2068,i,4626644964551767630,2611754995369333300,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2104 --mojo-platform-channel-handle=2100 /prefetch:11
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Time Discovery
                      PID:2392
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,8264483869585847873,3916937487312714245,262144 --field-trial-handle=1524,i,1478150681205649172,8379240989781992314,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2068,i,4626644964551767630,2611754995369333300,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2072 --mojo-platform-channel-handle=2032 /prefetch:2
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:3392
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=2384,i,18118334687682377641,14719780774810976021,524288 --field-trial-handle=1524,i,1478150681205649172,8379240989781992314,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2068,i,4626644964551767630,2611754995369333300,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=2516 --mojo-platform-channel-handle=2512 /prefetch:13
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:4004
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=5916,i,11097942358686405924,13960391014466022200,2097152 --field-trial-handle=1524,i,1478150681205649172,8379240989781992314,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2068,i,4626644964551767630,2611754995369333300,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=5952 --mojo-platform-channel-handle=5948 /prefetch:1
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2324
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=7128,i,1488935987377407798,4527277417654278187,524288 --field-trial-handle=1524,i,1478150681205649172,8379240989781992314,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2068,i,4626644964551767630,2611754995369333300,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7140 --mojo-platform-channel-handle=7132 /prefetch:14
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1544
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=7156,i,14199592641601477145,8907121773792388736,524288 --field-trial-handle=1524,i,1478150681205649172,8379240989781992314,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2068,i,4626644964551767630,2611754995369333300,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=6928 --mojo-platform-channel-handle=7152 /prefetch:14
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2216
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=1104,i,15365954327805760467,14473355718632347354,524288 --field-trial-handle=1524,i,1478150681205649172,8379240989781992314,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2068,i,4626644964551767630,2611754995369333300,4 --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=7180 --mojo-platform-channel-handle=7592 /prefetch:14
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2812
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=3348,i,1718563312581651826,1940053350489807260,524288 --field-trial-handle=1524,i,1478150681205649172,8379240989781992314,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2068,i,4626644964551767630,2611754995369333300,4 --trace-process-track-uuid=3190708995682289984 --enable-logging=handle --log-file=7616 --mojo-platform-channel-handle=7620 /prefetch:14
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:4388
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=7728,i,8926315211773303843,1768730158455960876,524288 --field-trial-handle=1524,i,1478150681205649172,8379240989781992314,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2068,i,4626644964551767630,2611754995369333300,4 --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=7628 --mojo-platform-channel-handle=6924 /prefetch:14
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:1720
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=1416,i,4057339279849462750,5019567610815231888,524288 --field-trial-handle=1524,i,1478150681205649172,8379240989781992314,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2068,i,4626644964551767630,2611754995369333300,4 --trace-process-track-uuid=3190708997556373682 --enable-logging=handle --log-file=3448 --mojo-platform-channel-handle=3436 /prefetch:14
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2388
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3140
                • C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe
                  "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe"
                  2⤵
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1072
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    Spotify.exe /INSTALLCOMPLETE
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:900
                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.94.582 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7fffa9465448,0x7fffa9465454,0x7fffa9465460
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      PID:2216
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                1⤵
                  PID:1660
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                  1⤵
                  • Modifies data under HKEY_USERS
                  PID:4184
                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:5092
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.94.582 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7fffb1275448,0x7fffb1275454,0x7fffb1275460
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2784
                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:1720
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.94.582 --initial-client-data=0x254,0x258,0x25c,0x250,0x260,0x7fffb1275448,0x7fffb1275454,0x7fffb1275460
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2088
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=2000,i,3581094592731617381,9385999900004685904,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2136 --mojo-platform-channel-handle=2128 /prefetch:11
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Time Discovery
                    PID:3368
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1788,i,7902165188174747297,8201647816201514833,262144 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2104 --mojo-platform-channel-handle=2092 /prefetch:2
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:3016
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=2480,i,8342393232646981702,1413160389335229697,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=2660 --mojo-platform-channel-handle=2652 /prefetch:13
                    2⤵
                    • Executes dropped EXE
                    PID:1544
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1784080566165443 --launch-time-ticks=759492509 --metrics-shmem-handle=5352,i,18094830524340725665,1013305905441748476,2097152 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=5580 --mojo-platform-channel-handle=5584 /prefetch:1
                    2⤵
                    • Executes dropped EXE
                    PID:5160
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=6940,i,2096095342207503610,390222782435797352,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=6948 --mojo-platform-channel-handle=6944 /prefetch:14
                    2⤵
                    • Executes dropped EXE
                    PID:1044
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.spotify.com/signup?forward_url=https%3A%2F%2Faccounts.spotify.com%2Foauth2%2Fv2%2Fauth%3Fclient_id%3D65b708073fc0480ea92a077233ca87bd%26response_type%3Dcode%26redirect_uri%3Dhttp%253A%252F%252F127.0.0.1%253A4381%252Flogin%26scope%3Dapp-remote-control%252Cplaylist-modify%252Cplaylist-modify-private%252Cplaylist-modify-public%252Cplaylist-read%252Cplaylist-read-collaborative%252Cplaylist-read-private%252Cstreaming%252Ctransfer-auth-session%252Csts-content-management%252Cugc-image-upload%252Cuser-follow-modify%252Cuser-follow-read%252Cuser-library-modify%252Cuser-library-read%252Cuser-modify%252Cuser-modify-playback-state%252Cuser-modify-private%252Cuser-personalized%252Cuser-read-birthdate%252Cuser-read-currently-playing%252Cuser-read-email%252Cuser-read-play-history%252Cuser-read-playback-position%252Cuser-read-playback-state%252Cuser-read-private%252Cuser-read-recently-played%252Cuser-top-read%26code_challenge_method%3DS256%26code_challenge%3DXw1Xc9hla-NvTnn3TYM5DE5RZ6m5_npzvViLCR348yg%26flow_ctx%3Df6d238b4-cde3-487c-82f0-d506f4b1d389%253A1784102947%26dpop_jkt%3D1r7bFFBUpRLQGUqG6QMxWUhBJxkMaSXR0BP_bI70Dhk%26utm_source%3Dspotify%26utm_medium%3Ddesktop-win32%26utm_campaign%3Dorganic&flow=login-accounts&creation_flow=desktop&creation_point=https%3A%2F%2Flogin.app.spotify.com%2F%3Fclient_id%3D65b708073fc0480ea92a077233ca87bd%26utm_source%3Dspotify%26utm_medium%3Ddesktop-win32%26utm_campaign%3Dorganic&flow_ctx=f6d238b4-cde3-487c-82f0-d506f4b1d389%3A1784102947
                    2⤵
                    • Drops file in Windows directory
                    • Enumerates system info in registry
                    • Modifies data under HKEY_USERS
                    • Modifies registry class
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:2300
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x304,0x7fffadd2c188,0x7fffadd2c194,0x7fffadd2c1a0
                      3⤵
                        PID:1468
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,14629205407962131733,13257614194948063443,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
                        3⤵
                        • System Time Discovery
                        PID:4284
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2044,i,10526480635676411800,427995664430395582,262144 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
                        3⤵
                          PID:2160
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,12918274779968228264,16364784293960460212,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:13
                          3⤵
                            PID:3092
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,4901585936707202746,15378440373423572200,2097152 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
                            3⤵
                              PID:2744
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,13555173745415008777,12848464926566218037,2097152 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
                              3⤵
                                PID:4332
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,10396450082780178102,10799822304732362080,2097152 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
                                3⤵
                                  PID:1864
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,9763855646431165690,6059985464727247287,2097152 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:9
                                  3⤵
                                    PID:4864
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,776870987957854842,7221401998602039549,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
                                    3⤵
                                      PID:5476
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,12920917244241948512,12662402948553226679,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
                                      3⤵
                                        PID:1420
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,10688724681395758136,9956431696824616955,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
                                        3⤵
                                          PID:4272
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1128858660198844477,10133145843989530960,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
                                          3⤵
                                            PID:5616
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1128858660198844477,10133145843989530960,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
                                            3⤵
                                              PID:792
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,7365110484430744928,16347535680928991007,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
                                              3⤵
                                                PID:3296
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,15020048008268476441,11172632411407624205,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
                                                3⤵
                                                  PID:5476
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,17813962966866345452,7436211905094087347,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=1396 /prefetch:14
                                                  3⤵
                                                    PID:1424
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,14347236029664627269,8241483959705506635,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
                                                    3⤵
                                                      PID:4300
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,12052029992091695202,5698029997962166077,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
                                                      3⤵
                                                        PID:4668
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,9623293225543239699,3309638126242310953,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
                                                        3⤵
                                                          PID:1444
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,4536677072219587025,587287242416634395,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=1488 /prefetch:14
                                                          3⤵
                                                            PID:3204
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,11767206530302149286,10308399342884060632,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
                                                            3⤵
                                                              PID:1860
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,17167291192048941187,1423261791493814161,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=1456 /prefetch:14
                                                              3⤵
                                                                PID:7148
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,16284058594958691917,11401525205266286626,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
                                                                3⤵
                                                                  PID:6848
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6256,i,13535361621681756659,10069563394942140312,262144 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:10
                                                                  3⤵
                                                                    PID:3232
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3048,i,14273102213442814865,4772570704111108819,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
                                                                    3⤵
                                                                      PID:7060
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,3062899128254829399,17906019646996088326,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
                                                                      3⤵
                                                                        PID:1792
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,8427757551438407260,5162137430189534192,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
                                                                        3⤵
                                                                          PID:2812
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,12750340060759715693,3727544224985006743,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
                                                                          3⤵
                                                                            PID:7072
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,8372896633964081449,3393703269766744181,524288 --field-trial-handle=2572,i,387842905777550041,10345461527084740915,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
                                                                            3⤵
                                                                              PID:6736
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                              3⤵
                                                                              • Enumerates system info in registry
                                                                              • Modifies data under HKEY_USERS
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:3152
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fffadd2c188,0x7fffadd2c194,0x7fffadd2c1a0
                                                                                4⤵
                                                                                  PID:4148
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1925383942962677129,3064768158475671623,262144 --field-trial-handle=2388,i,6815893167886560415,16248829352046731403,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
                                                                                  4⤵
                                                                                    PID:6724
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,15865544087058445458,9915939098664352328,524288 --field-trial-handle=2388,i,6815893167886560415,16248829352046731403,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
                                                                                    4⤵
                                                                                    • System Time Discovery
                                                                                    PID:6824
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,10201432842758216057,9229214938934731587,524288 --field-trial-handle=2388,i,6815893167886560415,16248829352046731403,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:13
                                                                                    4⤵
                                                                                      PID:2816
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,8495866555299781259,9391522335852849419,524288 --field-trial-handle=2388,i,6815893167886560415,16248829352046731403,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
                                                                                      4⤵
                                                                                        PID:4732
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,8495866555299781259,9391522335852849419,524288 --field-trial-handle=2388,i,6815893167886560415,16248829352046731403,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
                                                                                        4⤵
                                                                                          PID:6952
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5100,i,17919864128883982596,12635899651277038330,2097152 --field-trial-handle=2388,i,6815893167886560415,16248829352046731403,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
                                                                                          4⤵
                                                                                            PID:5276
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5104,i,11342078738985415217,8004286583052477988,2097152 --field-trial-handle=2388,i,6815893167886560415,16248829352046731403,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
                                                                                            4⤵
                                                                                              PID:4888
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,2892595723376310682,6667344446260721237,524288 --field-trial-handle=2388,i,6815893167886560415,16248829352046731403,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
                                                                                              4⤵
                                                                                                PID:248
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,5209601186987964874,9051688766529673150,524288 --field-trial-handle=2388,i,6815893167886560415,16248829352046731403,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:3384
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6072,i,8543720527740685750,6518147541812075702,2097152 --field-trial-handle=2388,i,6815893167886560415,16248829352046731403,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:7020
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                    4⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Enumerates system info in registry
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    • Modifies registry class
                                                                                                    PID:4784
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c0,0x7fffadd2c188,0x7fffadd2c194,0x7fffadd2c1a0
                                                                                                      5⤵
                                                                                                        PID:2116
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,11213933440554753412,2330171042376466265,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:11
                                                                                                        5⤵
                                                                                                        • System Time Discovery
                                                                                                        PID:3596
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,459753408245318123,5133417047817025206,262144 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:2
                                                                                                        5⤵
                                                                                                          PID:1796
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,504424603825652523,8776618966990215174,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
                                                                                                          5⤵
                                                                                                            PID:6160
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,1308178715374796977,169163416871915729,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
                                                                                                            5⤵
                                                                                                              PID:6600
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,1308178715374796977,169163416871915729,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
                                                                                                              5⤵
                                                                                                                PID:1672
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,16379402794576846011,11000249057649277328,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
                                                                                                                5⤵
                                                                                                                  PID:4788
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,2200698170189674991,3739362918938975048,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
                                                                                                                  5⤵
                                                                                                                    PID:6380
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,15789585432219772553,1339899776626211419,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
                                                                                                                    5⤵
                                                                                                                      PID:6148
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11455810613284617073,12103982535765515944,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
                                                                                                                      5⤵
                                                                                                                        PID:5632
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,7086465349339977157,7665722799230354310,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
                                                                                                                        5⤵
                                                                                                                          PID:1284
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,1687986439450381716,5901899668013415164,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
                                                                                                                          5⤵
                                                                                                                            PID:1644
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,8058182013364030032,3564437566185274409,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
                                                                                                                            5⤵
                                                                                                                              PID:1844
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5048,i,8820269985092493556,6399226018908027119,262144 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:10
                                                                                                                              5⤵
                                                                                                                                PID:5664
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,8261076459511922290,18062190262581676186,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
                                                                                                                                5⤵
                                                                                                                                  PID:1552
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,9133894949631927761,10682987577006567544,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:14
                                                                                                                                  5⤵
                                                                                                                                    PID:2184
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,9869690559409771308,9950275798652857001,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
                                                                                                                                    5⤵
                                                                                                                                      PID:6840
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,1811383065242419984,14291890125498034850,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
                                                                                                                                      5⤵
                                                                                                                                        PID:6116
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,10546847108976886573,13517663570600976027,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:14
                                                                                                                                        5⤵
                                                                                                                                          PID:3384
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,6705702204048378199,3678913475783487900,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
                                                                                                                                          5⤵
                                                                                                                                            PID:4604
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,14965243157568140017,11786589925082657338,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:14
                                                                                                                                            5⤵
                                                                                                                                              PID:3076
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,3889449050160426401,1451736467566560798,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
                                                                                                                                              5⤵
                                                                                                                                                PID:2656
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,2388433051779301715,7756870414173932954,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:14
                                                                                                                                                5⤵
                                                                                                                                                  PID:6888
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,2324186865352331886,7532873733583600635,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
                                                                                                                                                  5⤵
                                                                                                                                                    PID:6488
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,1050374812458286981,6712982728285947877,524288 --field-trial-handle=2672,i,174065931689610742,2668807417715137369,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:14
                                                                                                                                                    5⤵
                                                                                                                                                      PID:5192
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=2244,i,12781573867313601232,7435866182523838608,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=7152 --mojo-platform-channel-handle=6940 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2356
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=7272,i,2492189264254600534,6310876244827347619,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=7256 --mojo-platform-channel-handle=6940 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:3556
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=7512,i,8949347665447719162,12397621354493234292,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708995682289984 --enable-logging=handle --log-file=3300 --mojo-platform-channel-handle=7272 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2592
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=7312,i,1534913635747844226,15980257724744220016,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=3336 --mojo-platform-channel-handle=6992 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2532
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=3464,i,4456303336466578863,7919167317156113314,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708997556373682 --enable-logging=handle --log-file=7312 --mojo-platform-channel-handle=7476 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6972
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=3372,i,8640474411024317060,15372704137022147004,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708998493415531 --enable-logging=handle --log-file=7276 --mojo-platform-channel-handle=712 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:7024
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=7564,i,17453413500583211297,2117925946579414739,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190708999430457380 --enable-logging=handle --log-file=7584 --mojo-platform-channel-handle=7096 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4300
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=7536,i,6061943105291679604,3602867205567404504,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190709000367499229 --enable-logging=handle --log-file=7532 --mojo-platform-channel-handle=7568 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6212
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=7292,i,10140819914868377064,452300828298117864,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190709001304541078 --enable-logging=handle --log-file=7468 --mojo-platform-channel-handle=7288 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5884
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=enabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7160,i,8203662659280904641,2973953223376537574,262144 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190709002241582927 --enable-logging=handle --log-file=6952 --mojo-platform-channel-handle=7292 /prefetch:10
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2036
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=6976,i,3557127691066990944,12982159275045370966,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190709003178624776 --enable-logging=handle --log-file=3296 --mojo-platform-channel-handle=6952 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6792
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=3332,i,15215763473651580023,8998428425418491764,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190709004115666625 --enable-logging=handle --log-file=7372 --mojo-platform-channel-handle=7348 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6696
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=3212,i,11252767472298289050,15656061417750926495,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190709005052708474 --enable-logging=handle --log-file=6152 --mojo-platform-channel-handle=5920 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6388
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=6980,i,15758402391173693801,3176307971107991442,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190709005989750323 --enable-logging=handle --log-file=7256 --mojo-platform-channel-handle=7544 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2796
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=enabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.2.94.582" --metrics-shmem-handle=6956,i,1856766155371570835,17988194234254351995,524288 --field-trial-handle=2096,i,4000494214244559470,3775048496824665249,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2100,i,9039613176190311571,2367688005147291329,4 --trace-process-track-uuid=3190709006926792172 --enable-logging=handle --log-file=6152 --mojo-platform-channel-handle=7520 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6976
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.spotify.com/oauth2/v2/auth?client_id=65b708073fc0480ea92a077233ca87bd&response_type=code&redirect_uri=http%3A%2F%2F127.0.0.1%3A4382%2Flogin&scope=app-remote-control%2Cplaylist-modify%2Cplaylist-modify-private%2Cplaylist-modify-public%2Cplaylist-read%2Cplaylist-read-collaborative%2Cplaylist-read-private%2Cstreaming%2Ctransfer-auth-session%2Csts-content-management%2Cugc-image-upload%2Cuser-follow-modify%2Cuser-follow-read%2Cuser-library-modify%2Cuser-library-read%2Cuser-modify%2Cuser-modify-playback-state%2Cuser-modify-private%2Cuser-personalized%2Cuser-read-birthdate%2Cuser-read-currently-playing%2Cuser-read-email%2Cuser-read-play-history%2Cuser-read-playback-position%2Cuser-read-playback-state%2Cuser-read-private%2Cuser-read-recently-played%2Cuser-top-read&code_challenge_method=S256&code_challenge=abWz0GbTKnbvvgISBwzGp0UCvBNgDn6Ea9M_bfjLvUI&flow_ctx=89b4438b-d281-4fe8-840a-ad9c2f10a5a0%3A1784103132&dpop_jkt=KjSFCcyFppLn2bg97B0iHgeTlVTPM5Z8siJY16ggkvk&utm_source=spotify&utm_medium=desktop-win32&utm_campaign=organic&creation_flow=desktop&creation_point=https%3A%2F%2Flogin.app.spotify.com%2F%3Fclient_id%3D65b708073fc0480ea92a077233ca87bd%26utm_source%3Dspotify%26utm_medium%3Ddesktop-win32%26utm_campaign%3Dorganic&flow_ctx=89b4438b-d281-4fe8-840a-ad9c2f10a5a0%3A1784103132
                                                                                                                                                2⤵
                                                                                                                                                  PID:5044
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                1⤵
                                                                                                                                                  PID:1272
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4516
                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1840
                                                                                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                                                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
                                                                                                                                                      1⤵
                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                      PID:1088
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:6752
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:480
                                                                                                                                                        • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                          \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1280

                                                                                                                                                          Network

                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 3b8c99024ad3a25b5d717681418db1a849ddd053c3a900c307c286fbb1cf51cd
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 ed253711ed3d205930d2d276d3ed35146f870dbe2cb512d82b5b59e90f869c6e
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 280B
                                                                                                                                                                • SHA256 132913c2ed1318356671f5299d42f65c5ca4e13837684a7b180d66ee54833b7d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                6f836336-743c-42e0-93c4-c677ab256f91.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f836336-743c-42e0-93c4-c677ab256f91.tmp
                                                                                                                                                                • Size 106KB
                                                                                                                                                                • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                f_000049
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000049
                                                                                                                                                                • Size 373KB
                                                                                                                                                                • SHA256 a5c27d3298042314d98634f85836ab0c48cbdf572ee676981a852c3e18738d8e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                temp-index
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 f350a88cbe4bdb9810689e6134164255b234c93e72c2493bd946957da13031fc
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                the-real-index
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 1621a583a0ed935fd0ffe88fdc2e302d30855c1c465d8ea41e84de1b09cd7b54
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                SiteList-Enterprise.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                • Size 2B
                                                                                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                Edge Profile.ico
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                • Size 70KB
                                                                                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                • Size 5KB
                                                                                                                                                                • SHA256 7e1a4b18c7e026b0ea03544d918b9fa084082da4ce82d1b936acc27ca4ccd36f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                • Size 5KB
                                                                                                                                                                • SHA256 3fec1d583adc27a846ccaeecc91d8fd3f098118791ed9ad506d3dc52ab24c041
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                • Size 6KB
                                                                                                                                                                • SHA256 ca828def6b11b5667a2f1652c1e7f52f3f3ad450ab81e2e8a622c5dc0a54b795
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                • Size 5KB
                                                                                                                                                                • SHA256 5072131d1d5ddc8b87319d3236c39ea59665e92232e17db5d298f4ce58365dc3
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Sdch Dictionaries
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                • Size 40B
                                                                                                                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                TransportSecurity
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 9a88665d5256b8f0112b989c5a52bc8b5dc680edc85dd5fa66294006084f27df
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 14KB
                                                                                                                                                                • SHA256 3f073d8d463795ea6eb1069eed491fb2ad428ef057d3d3260794ef212212e21e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 17KB
                                                                                                                                                                • SHA256 a49dcd064bd81cb9a836b0ab42286b74f22c3e7eb1434b4989eea7ffa657daa7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 15KB
                                                                                                                                                                • SHA256 71a01e4f1d3cd5a795872293c9869973bc4e472e54ac6c91a1c789f175d41972
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 14KB
                                                                                                                                                                • SHA256 c8e52aa0f6e0dca5b2d9df6331635ace29ca46b98650afee7b7cb89932199b4d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 16KB
                                                                                                                                                                • SHA256 23cf1483c0b1a8a470f37b6dfb0907440d914cd0676df35fa7b9cd844c36c30c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 17KB
                                                                                                                                                                • SHA256 57623fd274f2fdc27913e22c655f8d862bea418cb7e31bd9821a3d63b57d6db3
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 14KB
                                                                                                                                                                • SHA256 1bf886b28e2752cd866fcf26e87fb3fa509a306f93b12ea7b111da17e4a57c3d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                • Size 14KB
                                                                                                                                                                • SHA256 1d803bfaf03ad44243644ba371f1e59ffa03d0d943048c4084badadccedd7f3c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Secure Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                • Size 32KB
                                                                                                                                                                • SHA256 405cb4bcdd37acc4ce0808d5052c4918a25923be5f57b393fdf171aa2a6375cb
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                sync_diagnostic.log
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                • Size 4KB
                                                                                                                                                                • SHA256 c71f16e02c78e41890e12c7123b54bd57563a8937a8cf819583cc342a832b006
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                aa3a3159-fa54-4680-921b-2631f8669553.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa3a3159-fa54-4680-921b-2631f8669553.tmp
                                                                                                                                                                • Size 414B
                                                                                                                                                                • SHA256 c870ce5bf2d6acc651cdb13b8ae618d651d2875bbef9659251107e82cc04573f
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                d8edfda3-603b-4ad6-92bb-1471dc3127b0.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8edfda3-603b-4ad6-92bb-1471dc3127b0.tmp
                                                                                                                                                                • Size 1B
                                                                                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                5dab4707-d9c7-4d8c-90a4-d9750f86dd51.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5dab4707-d9c7-4d8c-90a4-d9750f86dd51.tmp
                                                                                                                                                                • Size 22KB
                                                                                                                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 51KB
                                                                                                                                                                • SHA256 12f8b5569d39d5bfb42410fa0ef03395a66b9f019426437b1199c40aa6d41b72
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 35KB
                                                                                                                                                                • SHA256 6e17d720585b8a4513e0daf7f6190bf9c812a2825fdfb1ec9bf9290013769403
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 50KB
                                                                                                                                                                • SHA256 4fe49dc57fdcbed972ff3396db633f714b03d64a94eb342f571d1a4a00ce8da0
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 46KB
                                                                                                                                                                • SHA256 bd39ae62483eb941647e7ca6e4d30efbb2ec4db2d5e48c1487cbb0e2dc589d9c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 38KB
                                                                                                                                                                • SHA256 0f53242defa08aa7d06e1d92a4055dfdba3e6054fa9c867944fbbec12ec661e5
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 41KB
                                                                                                                                                                • SHA256 3f8cee28aeb8f96f6d68277bb3fd9de673998b36d6e291230a861bf3822f756c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 44KB
                                                                                                                                                                • SHA256 6b0d64a9193dd13e9fd96507b4e79b977008191484bd2875601eea4a6e29082b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 35KB
                                                                                                                                                                • SHA256 3595a8d20f759898d9ebfab087b966a2547c7a0417e64468392c17734207a0d4
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 43KB
                                                                                                                                                                • SHA256 0150a53471dded774e9f7ba500cba3bd4d65c476e20ed802d9a541b9568e5a67
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                • Size 44KB
                                                                                                                                                                • SHA256 a4003eb9806e13c2622ebc2f8909f681a8101955f69beceff8b95366182fce73
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                keys.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
                                                                                                                                                                • Size 8KB
                                                                                                                                                                • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                4ceb3b4b-9fcc-4c8d-b727-092ac2c01dfe.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4ceb3b4b-9fcc-4c8d-b727-092ac2c01dfe.tmp
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 ee92ec24cc7c5292e5c815737c0ff9428a5b7abbba549cbcf99a222411f61ab7
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 252B
                                                                                                                                                                • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 65fa7facd446dfe9b0e75e6161eea59e3c4e060d58a2c4916817dbb7dcc64a0b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 0e8b919f8d1beed3cd10d5c9baf5eb56b6de0668e18a6a61f1c4f157cbc67c70
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 372B
                                                                                                                                                                • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 ca4eb6cf2f6f2be03bc21c4e0cb5ff980a8448f2dde86666df04b7ba89b99058
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 02a19ab9bd389cef526f3c07eb3a139dd276ac169f1c795652bacaddfe67727f
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 aad2671bb41509f6be090a01a107ac318c6ceac26b6dffe2c546b8a71dd2be3d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 a3d3213ce6f8957f9e49e5c29341436811ee37d8288a7284c60b2c1122a28810
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 852B
                                                                                                                                                                • SHA256 7fad88d201ddeec44343e402ef6c0aea1b35732bae73d78a00db9b2068fcfaae
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 492B
                                                                                                                                                                • SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 293a5f69009729d846fb6809435af8f019770b6db4f29ccf9c430df98fe6d9f0
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 943eb013c1a49279ee369a86919fb69815df8f6b0923c3da522397d81804806a
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 2617ac1e83697f8a79249bb08483e005a5c61a744fb77832f59f4d4da7c9e88d
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 612B
                                                                                                                                                                • SHA256 98d9b184e4c7220b5aaf7ae412b0c1b3f32e3dc4933afcf852538b8082017b9e
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                • Size 972B
                                                                                                                                                                • SHA256 880a73821f81b977523d4be040ed4b09a4e664f91e32d24468177c23dab91698
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                BrowsingTopicsState
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\BrowsingTopicsState
                                                                                                                                                                • Size 414B
                                                                                                                                                                • SHA256 3aeb65ceec11eee056e3ebd57883f359956982840046815a592747497242ce56
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                the-real-index
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                • Size 72B
                                                                                                                                                                • SHA256 9f5fe6e05a1ae5b727d5a61d44809356c084ca93cfb5c4df1185b0e7bda54677
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                the-real-index
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                • Size 72B
                                                                                                                                                                • SHA256 df41e613f8faf38d5b23b65db25a6c3ec9096e0ad839e0baeb1302fded6007ca
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                the-real-index~RFe5b54c4.TMP
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe5b54c4.TMP
                                                                                                                                                                • Size 48B
                                                                                                                                                                • SHA256 aadf125670ed88d58d20ac9ac4a29b86537698eeaf9f7228d9af921b5f7d1bec
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                data_0
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
                                                                                                                                                                • Size 8KB
                                                                                                                                                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                Submit Download

                                                                                                                                                                data_1
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
                                                                                                                                                                • Size 264KB
                                                                                                                                                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                Submit Download

                                                                                                                                                                data_2
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
                                                                                                                                                                • Size 8KB
                                                                                                                                                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                Submit Download

                                                                                                                                                                data_3
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
                                                                                                                                                                • Size 8KB
                                                                                                                                                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
                                                                                                                                                                • Size 59B
                                                                                                                                                                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 5ad1e6f53a1de913412a59c2ab597cbf44ba7edb6269eb6b473d7e018545c0ca
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 5751347f13c7b3c5b565f778b523c93e2f455854e2ac649e7cefb1629121a4c6
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 78af4e52e0079c094422bc0c7541afce5f756f34b724cb45223f481c8ca59f8a
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                SCT Auditing Pending Reports
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\SCT Auditing Pending Reports
                                                                                                                                                                • Size 2B
                                                                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                TransportSecurity
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\TransportSecurity
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 6b68b99524727b4fd4c6ac6c078e0a66da13988bb0b77a21f565f2b365be9b38
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
                                                                                                                                                                • Size 11KB
                                                                                                                                                                • SHA256 b15335a75315f050828cc10ecca6473d8e9c75e8e45053afba59533d3fe777b5
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 79151e800b85dfe2b94841e42a36a610767184d3d64a1cdbb470358fb3a934f6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 be89cb6c44f02aef967f20adc4d310a62217b075640f0e1844f00732678ef097
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences~RFe5b4989.TMP
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe5b4989.TMP
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 bd287a0b71a42824722943ca94b50612ffa071352599a0052fe4b85cee271705
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Secure Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Secure Preferences
                                                                                                                                                                • Size 9KB
                                                                                                                                                                • SHA256 ccf4ee6983459c9e65fd8d2e9b79782b0431ac5e0f2ff4e08220d05641feb713
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                index
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Shared Dictionary\cache\index
                                                                                                                                                                • Size 24B
                                                                                                                                                                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                06ed6cd5-97f9-488d-ad06-3fa396914ee9.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\06ed6cd5-97f9-488d-ad06-3fa396914ee9.tmp
                                                                                                                                                                • Size 84B
                                                                                                                                                                • SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                BrowsingTopicsState
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\BrowsingTopicsState
                                                                                                                                                                • Size 414B
                                                                                                                                                                • SHA256 43ff27b477b280943597e027da5eacdd570ee883652277d44098b4ab19c97dbc
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
                                                                                                                                                                • Size 922B
                                                                                                                                                                • SHA256 2fa4a3f1344dc0bb8d0419c7ff8fd60af064fa982535bef116e43fd4a6749efd
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Network Persistent State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
                                                                                                                                                                • Size 922B
                                                                                                                                                                • SHA256 4f6e1da265e4e1d1a9ff9e666730097766638433f491477d7ed4815df1642638
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                TransportSecurity
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\TransportSecurity
                                                                                                                                                                • Size 523B
                                                                                                                                                                • SHA256 598070a5edd5e31803395e21d1314f24308882d260d8628daa25b1011f75bb85
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
                                                                                                                                                                • Size 8KB
                                                                                                                                                                • SHA256 33e96eb71aa6ea55da5f2bbb3c833fe0b8461a6e8aac86ca2aa0dc216094def8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
                                                                                                                                                                • Size 8KB
                                                                                                                                                                • SHA256 ec21ccc5da3b3055cfc936ffb0c24a792e957e881f3c2bc38c19f803081f84c8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Preferences~RFe5b1152.TMP
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe5b1152.TMP
                                                                                                                                                                • Size 7KB
                                                                                                                                                                • SHA256 3ca69845b0c76bbc3deb2866329ca1d25b7d15dbbf8419d8dff5b00d167ded5f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Secure Preferences
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Secure Preferences
                                                                                                                                                                • Size 9KB
                                                                                                                                                                • SHA256 2f88dbdd0094dac28737c839404c019010534863d99d01c896c25ee409a79681
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                CURRENT
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT
                                                                                                                                                                • Size 16B
                                                                                                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                MANIFEST-000001
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\MANIFEST-000001
                                                                                                                                                                • Size 41B
                                                                                                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                e783c9be-5f99-4336-84b2-c8007f76677b.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\e783c9be-5f99-4336-84b2-c8007f76677b.tmp
                                                                                                                                                                • Size 6B
                                                                                                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                f812716e-e981-413b-acba-35134b838fed.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\f812716e-e981-413b-acba-35134b838fed.tmp
                                                                                                                                                                • Size 9KB
                                                                                                                                                                • SHA256 9a1eaf39171131d0da3287c1cbe721b644816e6ebaa9a5329c7affaa27acf0be
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 7KB
                                                                                                                                                                • SHA256 4ebe4149b3ca10eaad094cc3cb93ff1acea117ce00a6a487eb2e370848706914
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 3KB
                                                                                                                                                                • SHA256 163d1a1132c410afd8ff613078a693199f551b14b09b3af4964b23c00745bbfd
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 7KB
                                                                                                                                                                • SHA256 330d1274914ddc7b39e93737fbc5859d984c6d1a5804c2ccad6160e16a86e79d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 2KB
                                                                                                                                                                • SHA256 871f6fb653a7c868c82713d370c1d288309ad2aab2f99ef76f0dacdc30cef0f3
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 6KB
                                                                                                                                                                • SHA256 efdbca3b69f81dfca2c16cc476fc71dc8d915bba6a478d8b6a7a5ea229a30cc0
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 7KB
                                                                                                                                                                • SHA256 d2910528a5d48c168c3e3669242764abe5ee08843a01bba0682234ec9715e86d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 6KB
                                                                                                                                                                • SHA256 f3c198afdfbf665ad09809bc11338bd7aec71ea80491970dc5cb5e243fe52e7d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 6KB
                                                                                                                                                                • SHA256 2af765a30ca3632bb28cad1fcfa11ab8b6f33010e4520367669e50528e60db88
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 6KB
                                                                                                                                                                • SHA256 e29dc1b8058ad47e449388b2cb7147c2183e3a41f70505428d7edc0ca6f1b3e6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 7KB
                                                                                                                                                                • SHA256 37445de4a2599a56034fa45cc8f0ec02354ba35cbe16db63ac11f9e560eaecee
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                                                                                                                                                • Size 7KB
                                                                                                                                                                • SHA256 91036b9eb3666c1394bf1d441eaf2dcc9e581b83705a50a7f1b2c296bdba6af7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Local State~RFe5ae689.TMP
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe5ae689.TMP
                                                                                                                                                                • Size 1008B
                                                                                                                                                                • SHA256 2f9926adef7e3af3e32469422b7d2a7c5607c3e6304413b5e1a93addbec12016
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                settings.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
                                                                                                                                                                • Size 56B
                                                                                                                                                                • SHA256 acec4c7e2ce5e0e87f5d488505a427f85672731f6f66fec5af8c58d2442541a4
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1020B
                                                                                                                                                                • SHA256 2dbfdc8d9c895ccae8ee7d0127cdad110f32c066afb406d12cd48ccb70c62bea
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                                                                                                                                                • Size 124B
                                                                                                                                                                • SHA256 418e37a64c865013c87c6d30e5094d292fa74fb46e449d968ac83f492e46407b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                                                                                                                                                • Size 460B
                                                                                                                                                                • SHA256 69d77ce5abd57afbc09e440cb2c3d904182663285002d6f42c72807d7a885dc3
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                                                                                                                                                • Size 684B
                                                                                                                                                                • SHA256 e4474e49a71cc1c497f09b9de07678d0676c9646bde8212e2b1917189e955bf3
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                                                                                                                                                • Size 236B
                                                                                                                                                                • SHA256 18ddfb5735b43666d3382c9f1a55777d572974e03314798a8b4263f8c46e839a
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                                                                                                                                                • Size 908B
                                                                                                                                                                • SHA256 b5f1b0ba9b9ccdf1d8382f514201eaff98e43627ff43e9f875457a261b3f3351
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 a291657ac93b5627f54a33eaeef40dc2affc61a82cd0babf3dae5344cb704648
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 f6a7cdb0c451776cabef8580325173d8cd0cb8fdbb66217b6761c3ab0224d21e
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                                                                                                                                                • Size 348B
                                                                                                                                                                • SHA256 1f13c9fa24189072fb4c2136dd53153c77108d85b24e7fc3dd3e4cb6db9b9724
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                metadata.json
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 6b016978694008d2acceb694f63819f176784f762b2d06e98f48f589d259b116
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                07a23026-811d-44da-a85c-61e4622f4915.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\07a23026-811d-44da-a85c-61e4622f4915.tmp
                                                                                                                                                                • Size 13B
                                                                                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                000002.dbtmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
                                                                                                                                                                • Size 16B
                                                                                                                                                                • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                000004.dbtmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000004.dbtmp
                                                                                                                                                                • Size 16B
                                                                                                                                                                • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                RES6301.tmp
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\RES6301.tmp
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 18761b7e58601f1137d9ef5dc182e33f5cf9baf2269a8a91f7ed1896f28d7a9a
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                py21myoe.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\py21myoe\py21myoe.dll
                                                                                                                                                                • Size 5KB
                                                                                                                                                                • SHA256 441f9763a27376247683b7e3cd33f230f9a6d9f228ac5ef522ac699a1869b265
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                content_new.js
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2300_1265097960\CRX_INSTALL\content_new.js
                                                                                                                                                                • Size 10KB
                                                                                                                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                default.exc
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                                                                                                                                                                • Size 2B
                                                                                                                                                                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                login.spa
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
                                                                                                                                                                • Size 3.9MB
                                                                                                                                                                • SHA256 8a72ea76b964e1ea0df40da9f0f959e66409f2a430daa8c0bf20644838c3e489
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                xpui.spa
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
                                                                                                                                                                • Size 10.7MB
                                                                                                                                                                • SHA256 9461357ea5139a830c2dad562476421c216e4f1d8cbf4c138a1017cc72cddca8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                xpui.spa
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
                                                                                                                                                                • Size 9.1MB
                                                                                                                                                                • SHA256 3f277cf770c614a7ea47c6812fa6508a2c497a9efbed5201d705c3a1b158f085
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                xpui.spa
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
                                                                                                                                                                • Size 12.1MB
                                                                                                                                                                • SHA256 216d5002222c79aa91d591375bab01c38521f19e413efac6a16438a19a96df55
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                D3DCompiler_47.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll
                                                                                                                                                                • Size 4.5MB
                                                                                                                                                                • SHA256 a10c01e0ff5abecf7a65687375847bfec4aa0d70c18e9439a2acc6ee67eb5b0b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Spotify.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
                                                                                                                                                                • Size 40.1MB
                                                                                                                                                                • SHA256 d80248f68230f2241871956652b5b0a3c3c26db4d8638ff9b92b5d27507056e6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Spotify.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
                                                                                                                                                                • Size 512KB
                                                                                                                                                                • SHA256 108287bfc24c7be1650f2fccf02c49c4c14b03a716fff70c6da0ee9af466aba6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Spotify.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
                                                                                                                                                                • Size 40.1MB
                                                                                                                                                                • SHA256 bac9485f84cbcac558b60dbd3f9f9f597c474dd7df3c2265177e109a996f3109
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Spotify.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
                                                                                                                                                                • Size 40.1MB
                                                                                                                                                                • SHA256 d5b56f0844fd66d84337bbc15878526c796ff4e93e49d994794257097ebe1317
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Spotify.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                                • Size 2.8MB
                                                                                                                                                                • SHA256 aace19a4f713561183a37db6ca01f1343e431acaba36816003a8f0bcbdb3c875
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Spotify.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                                                • Size 2.8MB
                                                                                                                                                                • SHA256 f8aec1dec7c565c7080b64903438e5ff65b6cb206ea01c06302628536c5394c6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                chrome_100_percent.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
                                                                                                                                                                • Size 705KB
                                                                                                                                                                • SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                chrome_200_percent.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                • SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                chrome_elf.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                                                                                                                                                                • Size 2.4MB
                                                                                                                                                                • SHA256 1c82eefb8145e92f8d267f7fea87b475ad084f7611c71c8df38ca2b8c31c96e7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                chrome_elf.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                                                                                                                                                                • Size 2.4MB
                                                                                                                                                                • SHA256 c1bf5ef26c11d28326683dfb61e8c53b26c5a1266aac13ed3adc4fa1b5830626
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                crash_reporter.cfg
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
                                                                                                                                                                • Size 632B
                                                                                                                                                                • SHA256 7b1be81fe871975a15d22d0bc0b0d5bf31909eeda5d91a5a86b846239991ddd1
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                icudtl.dat
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
                                                                                                                                                                • Size 10.3MB
                                                                                                                                                                • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                libegl.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\libegl.dll
                                                                                                                                                                • Size 504KB
                                                                                                                                                                • SHA256 561b6c11e3e876e35676705f924bf9aa6b06acef73ffc4952c427589a567a621
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                libglesv2.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll
                                                                                                                                                                • Size 7.5MB
                                                                                                                                                                • SHA256 fe2e3e00631a2d13a42b460bc7cb8d681b4efe3f423834b724c1956f247921c4
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                en-US.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
                                                                                                                                                                • Size 577KB
                                                                                                                                                                • SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                en.mo
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
                                                                                                                                                                • Size 16KB
                                                                                                                                                                • SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                zh-Hant.mo
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
                                                                                                                                                                • Size 16KB
                                                                                                                                                                • SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                prefs
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\prefs
                                                                                                                                                                • Size 154B
                                                                                                                                                                • SHA256 123863192d1f38933def7d9605544931209752f77d756602c014228cbebaf3c8
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                resources.pak
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
                                                                                                                                                                • Size 17.8MB
                                                                                                                                                                • SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                v8_context_snapshot.bin
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
                                                                                                                                                                • Size 16.6MB
                                                                                                                                                                • SHA256 0187a9dd2e67d224d261785ef4235e804392ba1a24d20c2556c5c751e65d0800
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                vk_swiftshader.dll
                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                • SHA256 a411ad23cb34a9f7096c6eec3d272aac5807d7add59bf5f7728e864e68dd0894
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                LICENSE
                                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2300_901395762\LICENSE
                                                                                                                                                                • Size 1KB
                                                                                                                                                                • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                ranked_dicts
                                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_1861784026\ranked_dicts
                                                                                                                                                                • Size 865KB
                                                                                                                                                                • SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                manifest.json
                                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_209119113\manifest.json
                                                                                                                                                                • Size 79B
                                                                                                                                                                • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Staging
                                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4784_2123035114\Mu\Staging
                                                                                                                                                                • Size 36B
                                                                                                                                                                • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                Submit Download

                                                                                                                                                                hyph-bn.hyb
                                                                                                                                                                • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping1720_182893134\hyph-bn.hyb
                                                                                                                                                                • Size 703B
                                                                                                                                                                • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                hyph-mr.hyb
                                                                                                                                                                • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping1720_182893134\hyph-mr.hyb
                                                                                                                                                                • Size 687B
                                                                                                                                                                • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                hyph-nn.hyb
                                                                                                                                                                • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping1720_182893134\hyph-nn.hyb
                                                                                                                                                                • Size 141KB
                                                                                                                                                                • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                CSC544644FA25894BB1922CAA82273CAB89.TMP
                                                                                                                                                                • Path \??\c:\Users\Admin\AppData\Local\Temp\py21myoe\CSC544644FA25894BB1922CAA82273CAB89.TMP
                                                                                                                                                                • Size 652B
                                                                                                                                                                • SHA256 37d9d05e7ab113724973ecd17c36f8c184478a73625f3a2ecefaa5abaf61fddd
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                py21myoe.0.cs
                                                                                                                                                                • Path \??\c:\Users\Admin\AppData\Local\Temp\py21myoe\py21myoe.0.cs
                                                                                                                                                                • Size 8KB
                                                                                                                                                                • SHA256 78e0ec5b518d24be43e349f9306c1410c602ffe34136e1c5c97369747d266633
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                py21myoe.cmdline
                                                                                                                                                                • Path \??\c:\Users\Admin\AppData\Local\Temp\py21myoe\py21myoe.cmdline
                                                                                                                                                                • Size 369B
                                                                                                                                                                • SHA256 0b5700bfd3799afb1f15990c3e35abcedeffa199ee42b6b4adc47c071145482f
                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                memory/1088-2123-0x00000281994D0000-0x00000281995D0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1720-3633-0x000001D6E7330000-0x000001D6E79B0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/1720-1374-0x000001D6E7330000-0x000001D6E79B0000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2036-2603-0x000002700C2F0000-0x000002700C2F1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2036-2605-0x000002700C2F0000-0x000002700C2F1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2036-2611-0x000002700C2F0000-0x000002700C2F1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2036-2609-0x000002700C2F0000-0x000002700C2F1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2036-2610-0x000002700C2F0000-0x000002700C2F1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2036-2614-0x000002700C2F0000-0x000002700C2F1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2036-2612-0x000002700C2F0000-0x000002700C2F1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2036-2613-0x000002700C2F0000-0x000002700C2F1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2975-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2976-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2977-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2980-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2979-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2978-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2981-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2982-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2983-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2984-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2985-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2965-0x0000029043CB0000-0x0000029043CB1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2967-0x0000029043CB0000-0x0000029043CB1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2970-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2968-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/2796-2974-0x0000029043D10000-0x0000029043D12000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-29-0x000001DDF0250000-0x000001DDF0454000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-26-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-39-0x000001DDEF140000-0x000001DDEF230000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-40-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-440-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-439-0x000001DDEF140000-0x000001DDEF230000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-42-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-410-0x000001DDEE770000-0x000001DDEE778000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-376-0x000001DDEFAB0000-0x000001DDEFAC2000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-375-0x000001DDEFA80000-0x000001DDEFA8A000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-43-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-37-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-0-0x00007FFFAF95F000-0x00007FFFAF960000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-3-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-48-0x000001DDEF140000-0x000001DDEF230000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-32-0x000001DDEF290000-0x000001DDEF298000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-36-0x000001DDEF320000-0x000001DDEF346000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-33-0x000001DDEF2C0000-0x000001DDEF2C6000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-35-0x000001DDEF2E0000-0x000001DDEF2E8000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-34-0x000001DDEF2D0000-0x000001DDEF2DA000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-31-0x000001DDEF370000-0x000001DDEF39A000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-30-0x000001DDEF2A0000-0x000001DDEF2BA000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-28-0x000001DDEFB10000-0x000001DDF0038000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-27-0x000001DDEF410000-0x000001DDEF5D2000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-24-0x000001DDEF170000-0x000001DDEF19A000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-38-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-25-0x000001DDEF170000-0x000001DDEF194000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-20-0x000001DDEF060000-0x000001DDEF07E000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-22-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-4-0x000001DDEEB70000-0x000001DDEEB92000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-5-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-23-0x000001DDEEF40000-0x000001DDEEF4A000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-21-0x000001DDEF080000-0x000001DDEF132000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-6-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-17-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-7-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-16-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-15-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-14-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-13-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-12-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-11-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-10-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-8-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/3372-9-0x00007FFFAF7D0000-0x00007FFFB0174000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4004-524-0x00007FFFD22E0000-0x00007FFFD22E1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4004-523-0x00007FFFD20E0000-0x00007FFFD20E1000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4212-732-0x000002A554C00000-0x000002A555280000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4212-445-0x00007FFFA0D50000-0x00007FFFA35AE000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4212-444-0x00007FFFA0D50000-0x00007FFFA35AE000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4212-1246-0x000002A554C00000-0x000002A555280000-memory.dmp
                                                                                                                                                                Download

                                                                                                                                                                memory/4212-1247-0x00007FFFA0D50000-0x00007FFFA35AE000-memory.dmp
                                                                                                                                                                Download