Overview

overview

8

Static

static

1

App Installer.bat

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    488s
  • max time network
    512s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 16:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    App Installer.bat
  • Size 20KB
  • Sample260925-tnddmsvyfx
  • SHA256 dbf7f730f2a046fc3d15126947f3484c63ddf7ee7f7f1f978ade6e803dfcafc7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 39 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes 1 TTPs 9 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 9 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\App Installer.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Windows\system32\chcp.com
      chcp 65001
      2⤵
        PID:1084
      • C:\Windows\system32\curl.exe
        curl.exe -L --fail --silent --show-error "https://download.scdn.co/SpotifySetup.exe" -o "C:\Users\Admin\AppData\Local\Temp\CustomInstaller\SpotifySetup.exe"
        2⤵
        • Downloads MZ/PE file
        PID:5892
      • C:\Windows\explorer.exe
        explorer.exe "C:\Users\Admin\AppData\Local\Temp\CustomInstaller\SpotifySetup.exe"
        2⤵
          PID:3760
        • C:\Windows\system32\timeout.exe
          timeout /t 3 /nobreak
          2⤵
          • Delays execution with timeout.exe
          PID:1340
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq SpotifySetup.exe"
          2⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:5488
        • C:\Windows\system32\find.exe
          find /I "SpotifySetup.exe"
          2⤵
            PID:3940
          • C:\Windows\system32\timeout.exe
            timeout /t 2 /nobreak
            2⤵
            • Delays execution with timeout.exe
            PID:4452
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq SpotifySetup.exe"
            2⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:4564
          • C:\Windows\system32\find.exe
            find /I "SpotifySetup.exe"
            2⤵
              PID:4796
            • C:\Windows\system32\timeout.exe
              timeout /t 2 /nobreak
              2⤵
              • Delays execution with timeout.exe
              PID:5268
            • C:\Windows\system32\tasklist.exe
              tasklist /FI "IMAGENAME eq SpotifySetup.exe"
              2⤵
              • Discovers running processes
              • Suspicious use of AdjustPrivilegeToken
              PID:1512
            • C:\Windows\system32\find.exe
              find /I "SpotifySetup.exe"
              2⤵
                PID:2300
              • C:\Windows\system32\timeout.exe
                timeout /t 2 /nobreak
                2⤵
                • Delays execution with timeout.exe
                PID:5228
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq SpotifySetup.exe"
                2⤵
                • Discovers running processes
                • Suspicious use of AdjustPrivilegeToken
                PID:2192
              • C:\Windows\system32\find.exe
                find /I "SpotifySetup.exe"
                2⤵
                  PID:3616
                • C:\Windows\system32\timeout.exe
                  timeout /t 2 /nobreak
                  2⤵
                  • Delays execution with timeout.exe
                  PID:3964
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq SpotifySetup.exe"
                  2⤵
                  • Discovers running processes
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5612
                • C:\Windows\system32\find.exe
                  find /I "SpotifySetup.exe"
                  2⤵
                    PID:5372
                  • C:\Windows\system32\timeout.exe
                    timeout /t 2 /nobreak
                    2⤵
                    • Delays execution with timeout.exe
                    PID:2596
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq SpotifySetup.exe"
                    2⤵
                    • Discovers running processes
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3020
                  • C:\Windows\system32\find.exe
                    find /I "SpotifySetup.exe"
                    2⤵
                      PID:3412
                    • C:\Windows\system32\timeout.exe
                      timeout /t 2 /nobreak
                      2⤵
                      • Delays execution with timeout.exe
                      PID:4296
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FI "IMAGENAME eq SpotifySetup.exe"
                      2⤵
                      • Discovers running processes
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2740
                    • C:\Windows\system32\find.exe
                      find /I "SpotifySetup.exe"
                      2⤵
                        PID:4684
                      • C:\Windows\system32\timeout.exe
                        timeout /t 2 /nobreak
                        2⤵
                        • Delays execution with timeout.exe
                        PID:360
                      • C:\Windows\system32\tasklist.exe
                        tasklist /FI "IMAGENAME eq SpotifySetup.exe"
                        2⤵
                        • Discovers running processes
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3104
                      • C:\Windows\system32\find.exe
                        find /I "SpotifySetup.exe"
                        2⤵
                          PID:784
                        • C:\Windows\system32\timeout.exe
                          timeout /t 2 /nobreak
                          2⤵
                          • Delays execution with timeout.exe
                          PID:2976
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq SpotifySetup.exe"
                          2⤵
                          • Discovers running processes
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4796
                        • C:\Windows\system32\find.exe
                          find /I "SpotifySetup.exe"
                          2⤵
                            PID:4084
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:5944
                          • C:\Users\Admin\AppData\Local\Temp\CustomInstaller\SpotifySetup.exe
                            "C:\Users\Admin\AppData\Local\Temp\CustomInstaller\SpotifySetup.exe"
                            2⤵
                            • Downloads MZ/PE file
                            • Executes dropped EXE
                            • Reads the TCP/IP host and domain name from the registry
                            • Suspicious use of WriteProcessMemory
                            PID:3716
                            • C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
                              SpWebInst0.exe /webinstall
                              3⤵
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:2384
                              • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                Spotify.exe /INSTALLCOMPLETE
                                4⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Adds Run key to start application
                                • Drops file in Windows directory
                                • Reads the TCP/IP host and domain name from the registry
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of WriteProcessMemory
                                PID:6096
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.3.1.234 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ffaf06e5448,0x7ffaf06e5454,0x7ffaf06e5460
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:1692
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=2184,i,16629656016289702789,80974573821765198,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2644 --mojo-platform-channel-handle=2640 /prefetch:11
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Reads the TCP/IP host and domain name from the registry
                                  • System Time Discovery
                                  PID:5372
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2288,i,1977673141651396925,3823490602162561810,262144 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2612 --mojo-platform-channel-handle=2600 /prefetch:2
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:2948
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=2888,i,9340887062071630001,12357318461786396510,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=3116 --mojo-platform-channel-handle=3112 /prefetch:13
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:5472
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=6104,i,7257216218264372870,15094815088230775284,2097152 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=6196 --mojo-platform-channel-handle=6192 /prefetch:1
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:5028
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7744,i,5313394939564362026,8078647253473421057,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=7748 --mojo-platform-channel-handle=7752 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:4152
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7780,i,9289076364986034808,14155632212102355504,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708993808206286 --enable-logging=handle --log-file=6844 --mojo-platform-channel-handle=6832 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:4432
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7952,i,17528751481524335162,11134558681395362632,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=7964 --mojo-platform-channel-handle=7960 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:5980
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=8116,i,11439278659683766024,11760624478916345889,262144 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708995682289984 --enable-logging=handle --log-file=7972 --mojo-platform-channel-handle=7980 /prefetch:10
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2820
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=6552,i,15752546055765474837,17627807842581644174,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=4296 --mojo-platform-channel-handle=2768 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:5100
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=2772,i,15951475984289322374,15837995690480133289,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708997556373682 --enable-logging=handle --log-file=8140 --mojo-platform-channel-handle=8156 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:4816
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=8152,i,3868549642972471176,13412735760590282268,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708998493415531 --enable-logging=handle --log-file=8124 --mojo-platform-channel-handle=8164 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:6048
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=8024,i,5750957600904083665,10995542365934671504,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190708999430457380 --enable-logging=handle --log-file=5600 --mojo-platform-channel-handle=8172 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:1756
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=2772,i,5008870799340333341,2722376005480640534,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709000367499229 --enable-logging=handle --log-file=8172 --mojo-platform-channel-handle=7832 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:3712
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=1704,i,6181780877236984450,9053437693884880497,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709001304541078 --enable-logging=handle --log-file=8184 --mojo-platform-channel-handle=4124 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:4504
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=4124,i,4670185577426469401,17211631897525104168,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709002241582927 --enable-logging=handle --log-file=8040 --mojo-platform-channel-handle=2772 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2488
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=8052,i,14782169346496736474,6321841913284743874,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709003178624776 --enable-logging=handle --log-file=8140 --mojo-platform-channel-handle=7832 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5480
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=4296,i,1207041017119931045,5800890545000473980,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709004115666625 --enable-logging=handle --log-file=6992 --mojo-platform-channel-handle=8156 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1728
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=8052,i,13459061770319163146,7245709652725331357,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709005052708474 --enable-logging=handle --log-file=7768 --mojo-platform-channel-handle=2100 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:6104
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=8136,i,16270690540759879686,10506706817413187120,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709005989750323 --enable-logging=handle --log-file=5596 --mojo-platform-channel-handle=6268 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:960
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7276,i,7240428316971410582,12507447515083969922,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709006926792172 --enable-logging=handle --log-file=8168 --mojo-platform-channel-handle=7960 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5836
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7992,i,12567045632058281807,10196911655904648891,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709007863834021 --enable-logging=handle --log-file=8156 --mojo-platform-channel-handle=8108 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2488
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7768,i,1780491476297429833,16450222674131854246,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709008800875870 --enable-logging=handle --log-file=8040 --mojo-platform-channel-handle=8048 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:4276
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=2772,i,8835339816757968641,8771597041986789302,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709009737917719 --enable-logging=handle --log-file=7260 --mojo-platform-channel-handle=7196 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2972
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7784,i,4874836995994307191,14930227127082581331,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709010674959568 --enable-logging=handle --log-file=7976 --mojo-platform-channel-handle=2268 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2356
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=4116,i,6759343490386142196,8345292643809119096,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709011612001417 --enable-logging=handle --log-file=7196 --mojo-platform-channel-handle=7900 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3144
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=1704,i,12886735922716292850,10448849996255728824,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709012549043266 --enable-logging=handle --log-file=7752 --mojo-platform-channel-handle=7760 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3432
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=8084,i,12955872632590571743,11707659372126438917,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709013486085115 --enable-logging=handle --log-file=7996 --mojo-platform-channel-handle=8156 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5832
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7000,i,3353597834808378915,4922869441580025538,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709014423126964 --enable-logging=handle --log-file=7916 --mojo-platform-channel-handle=2268 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3628
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7260,i,17131776625884569440,14348906998516935743,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709015360168813 --enable-logging=handle --log-file=7996 --mojo-platform-channel-handle=5780 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2416
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=5780,i,8330868081036269749,5319380832191064938,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709016297210662 --enable-logging=handle --log-file=2268 --mojo-platform-channel-handle=7012 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1784
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=8036,i,4573229275872008486,5960360620271961574,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709017234252511 --enable-logging=handle --log-file=8052 --mojo-platform-channel-handle=3908 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:5984
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7980,i,3145543546214294971,12851844068193046212,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709018171294360 --enable-logging=handle --log-file=6992 --mojo-platform-channel-handle=732 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:1096
                                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                  "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/146.0.7680.179 Spotify/1.3.1.234" --metrics-shmem-handle=7980,i,12780697235260164181,15254815588686569209,524288 --field-trial-handle=2604,i,8976110551985842190,9409276022084671894,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2608,i,9022170831977829134,9148349258600075657,4 --trace-process-track-uuid=3190709019108336209 --enable-logging=handle --log-file=6840 --mojo-platform-channel-handle=8088 /prefetch:14
                                  5⤵
                                  • Executes dropped EXE
                                  PID:464
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:3628
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                            1⤵
                            • Modifies data under HKEY_USERS
                            PID:3916
                          • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                            "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
                            1⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:2188
                            • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                              C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.3.1.234 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ffaf06e5448,0x7ffaf06e5454,0x7ffaf06e5460
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:5172
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            1⤵
                            • Suspicious use of FindShellTrayWindow
                            PID:4308
                            • C:\Windows\explorer.exe
                              explorer.exe /LOADSAVEDWINDOWS
                              2⤵
                              • Boot or Logon Autostart Execution: Active Setup
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:4252
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:6076
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1812

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                1
                                T1059

                                Windows Command Shell

                                1
                                T1059.003

                                Persistence

                                Boot or Logon Autostart Execution

                                2
                                T1547

                                Active Setup

                                1
                                T1547.014

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Event Triggered Execution

                                1
                                T1546

                                Component Object Model Hijacking

                                1
                                T1546.015

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                2
                                T1547

                                Active Setup

                                1
                                T1547.014

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Event Triggered Execution

                                1
                                T1546

                                Component Object Model Hijacking

                                1
                                T1546.015

                                Defense Evasion

                                Modify Registry

                                3
                                T1112

                                Credential Access

                                Discovery

                                Peripheral Device Discovery

                                2
                                T1120

                                Process Discovery

                                1
                                T1057

                                Query Registry

                                6
                                T1012

                                System Information Discovery

                                5
                                T1082

                                System Network Configuration Discovery

                                1
                                T1016

                                System Time Discovery

                                1
                                T1124

                                Lateral Movement

                                Collection

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                prep_Activatable Class_Hermes_perf.cache
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                • Size 599B
                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                the-real-index
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
                                • Size 72B
                                • SHA256 6eb351777dac8bf8ef53e8e381e3b7a5a8e728d4b68dbf58daf0904dcb104df9
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                the-real-index
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
                                • Size 72B
                                • SHA256 fd49094a2b3b5bfbfe4193098fbb136d7eb62ea1e4b2615d44b47deb95046733
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                the-real-index~RFe5bee64.TMP
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index~RFe5bee64.TMP
                                • Size 48B
                                • SHA256 28eb0e12c567200dbb1674a2f57cd09765da6b6c94a429ecfe618cc0e1bc81b9
                                • MD5 SHA1 SHA512
                                Submit Download

                                data_0
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
                                • Size 8KB
                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_1
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
                                • Size 264KB
                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_2
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
                                • Size 8KB
                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_3
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
                                • Size 8KB
                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                Network Persistent State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State
                                • Size 738B
                                • SHA256 0892cec26bc4a828a2cff984fad70dd92b6c55a035515525312818c6b502d86f
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                SCT Auditing Pending Reports
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\SCT Auditing Pending Reports
                                • Size 2B
                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                • MD5 SHA1 SHA512
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
                                • Size 10KB
                                • SHA256 f29e9fcc44453b7452062b04063c6206423cfcbb6b949f54466fb3690a2b1035
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
                                • Size 10KB
                                • SHA256 6f5c0c3c049b1a164b801bead6de628d90c1b56df654e6e1402f7ae14112a09b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences~RFe5c1a36.TMP
                                • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences~RFe5c1a36.TMP
                                • Size 9KB
                                • SHA256 b00702d28e94d55e3545f472a2730bd723f1e172de7061ada5cc5d54abe3651b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MANIFEST-000001
                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
                                • Size 41B
                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                • MD5 SHA1 SHA512
                                Submit Download

                                Network Persistent State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
                                • Size 359B
                                • SHA256 f50e205b7441e01d79834d23588406d5edcf7b886c3d8b758b9991a9224c04fa
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Network Persistent State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\Network Persistent State
                                • Size 59B
                                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
                                • Size 8KB
                                • SHA256 168ad2c358ba2385c80bb07ae21a4122c45ecb99772d7f18f97e05a29c8790f7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences
                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
                                • Size 8KB
                                • SHA256 dc0fd89bdae4118b701b09bdd2d453119ec03e248b2ded0e27c4db4ff575b651
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Preferences~RFe5c1a36.TMP
                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences~RFe5c1a36.TMP
                                • Size 7KB
                                • SHA256 84e71934447e1475192982d8324f464c47f165f24e749d11621430fe7f7f2429
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                index
                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Shared Dictionary\cache\index
                                • Size 24B
                                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                • MD5 SHA1 SHA512
                                Submit Download

                                CURRENT
                                • Path C:\Users\Admin\AppData\Local\Spotify\Default\Site Characteristics Database\CURRENT
                                • Size 16B
                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                • MD5 SHA1 SHA512
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                • Size 3KB
                                • SHA256 c08fe4c88020cee03e026f67abb6ed772f198d4ac0a90e100dee1bec95340336
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                • Size 6KB
                                • SHA256 a1cdfce4feec9dc5e4b41f9a79a8c1db79238954bdefb06ee2d1b81edf2845fb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                • Size 6KB
                                • SHA256 2a16f8e9eadbbc966ba526509c52ede076b4ff03ca30e65f71fe988a6ecef930
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                • Size 6KB
                                • SHA256 ce28540178240d12cfcd3c3fbf90c037e584eaf863db3bdb12be0f15925c1f0b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                • Size 6KB
                                • SHA256 d9a6f151c53d15568bc492654443c4ef01d21dfaeae1ca3bf3649294dc8df0ac
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                • Size 6KB
                                • SHA256 5d20fcbf34f59f295bae1b89e178c5585406b8304573aa44ac235f430efe0f0b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                • Size 7KB
                                • SHA256 285a2f16fb5d05ad08ac995868ea9beb7c3276727fd4a828bf7b996d1501a3b7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State
                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State
                                • Size 7KB
                                • SHA256 64304b245e8a6bd65df6e1b1f60deb85679c34ff30130069127a3a39c70271af
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Local State~RFe5beec1.TMP
                                • Path C:\Users\Admin\AppData\Local\Spotify\Local State~RFe5beec1.TMP
                                • Size 1008B
                                • SHA256 63edb91f58a0f265c2a698458cedc6cbe54503d1981adba5ce44f06dd395f291
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
                                • Size 56B
                                • SHA256 2e7fcdba47b29169c7337a469e90a4a3f2f141005c16f68399a469a05ca7721f
                                • MD5 SHA1 SHA512
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 796B
                                • SHA256 e0efe94baaeb6ee16b6a6439d069b5129d5ae4d84fbd865b383f5968b8d7a788
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 236B
                                • SHA256 3ed431e5622aacd5228a5a88fc20af6fd100f436b955503d7f9cd55e9f9a15e1
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 1KB
                                • SHA256 36a59c41488e4acb5d9ed7148dbc484a19958b8df35957d1d49b8b3d078e2a1e
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 572B
                                • SHA256 5d6f7418bf376708db90b302fa80bd0c4ce2b5a1095dc94524cdbffedf9c80c6
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 124B
                                • SHA256 418e37a64c865013c87c6d30e5094d292fa74fb46e449d968ac83f492e46407b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 1KB
                                • SHA256 1ff0922f7003cc85ae94c747957905776f6356ffdf02dbc20fc97bc8c8175b9d
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 1KB
                                • SHA256 9f67201c0f7bd43e48a939227a94e47e616cd8b6bccf050bd04d6970ce715906
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 348B
                                • SHA256 0abbd569278a5913cb58d3d25b314c1aef5039c6d3bf56054033ea3c19eb8113
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 684B
                                • SHA256 b766bc246da9fa5a6fdf709d45f6ffd97781b4d3374b7e7c89520f8cc9e3210d
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 1KB
                                • SHA256 2042214040be48e07ac042fe0bc82b873c5040a70d0aed333bb340e6cb5528d8
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 908B
                                • SHA256 79cd333dbd1044bc9dfcaa3b8d080f5c41ade613db280fbf5916023ce1f4ac02
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 1KB
                                • SHA256 77fbda5b4f032aac78aeb2948bdb7009d364d75073ad6db61b2ec752a345cb4b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 1020B
                                • SHA256 617d3dee1619f8a928c637df250dd880a61b5e5f6bfc2f4e6382ac8a90d5143c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 1KB
                                • SHA256 cb2dcb90ccedc8f6d296490b0aa09ea8e2a62a34d48e949f0f2f962e30ec1321
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 1KB
                                • SHA256 5ad69f20f6ccf2216123559636892f1c87e5dc3ef779092be010070b4724e698
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 2KB
                                • SHA256 896c7a780f48b8f2f60eadd630896d9624cadc9b45b135a8e03574d36fcf677f
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 1KB
                                • SHA256 e79cbb1f1a9e608fd24c3c1bb1dee3a1df8a80a11345f8e62c9cdb2d3d99f807
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                metadata.json
                                • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\metadata.json
                                • Size 1KB
                                • SHA256 6441c501992d753d01bc1358459c6fbea126f3c4ece2ddec05df3e402af35835
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                d4e65405-c64e-4462-8163-bb77b57471bb.tmp
                                • Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\d4e65405-c64e-4462-8163-bb77b57471bb.tmp
                                • Size 13B
                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                • MD5 SHA1 SHA512
                                Submit Download

                                000002.dbtmp
                                • Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
                                • Size 16B
                                • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                • MD5 SHA1 SHA512
                                Submit Download

                                SpotifySetup.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\CustomInstaller\SpotifySetup.exe
                                • Size 1.0MB
                                • SHA256 f14487015a986e4a3af31222a2867ce181298419c67dcbfcfff6bbbfaa50232f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                login.spa
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
                                • Size 3.8MB
                                • SHA256 6578c6df6edaeccabc1ea69b7723e175bd3fb6b5d0453b933b45da52a92375cf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                D3DCompiler_47.dll
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\D3DCompiler_47.dll
                                • Size 4.5MB
                                • SHA256 f8f699d0b9da81cc6547c5dc8038b58e2e7f483207a0478a81ca62b62040be81
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Spotify.dll
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
                                • Size 40.9MB
                                • SHA256 0731eca3ec438395815907c04653c63a917b55bf0ebdd83c96f041424a92b54b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                Spotify.exe
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                • Size 2.8MB
                                • SHA256 51712e30e17263764e2a4595164a19110174fd8edd4c8095d3b53946a123d695
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                chrome_100_percent.pak
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
                                • Size 705KB
                                • SHA256 2c7dd3dc856c0389e56690e6c1bd3c509be950b95831972d5b4a78422cc14a3b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                chrome_200_percent.pak
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
                                • Size 1.2MB
                                • SHA256 b65200138ef17d5a462da4f11ed93e98a779efa8260454a6d4266205ebbd4caf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                chrome_elf.dll
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                                • Size 2.4MB
                                • SHA256 bb15c2b2adf4703fb53f9efbf4977c2fdf6857c17946795928f3ea56629c3957
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                crash_reporter.cfg
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
                                • Size 631B
                                • SHA256 91f5ffbc16fb5fa7fa77a84ea5c8dc7d42e481e95a2b88f25b4531d38d8b9725
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                icudtl.dat
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
                                • Size 10.3MB
                                • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libEGL.dll
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
                                • Size 504KB
                                • SHA256 84346bf58e8e1ab7d8c7cad803566476f9cee9880bc36737ac85e6eb07ff71bf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                libglesv2.dll
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\libglesv2.dll
                                • Size 7.5MB
                                • SHA256 1d14c828cb9dc37634168ee42cf38e0653760aa242c4e35aed291899d29e8421
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                en-US.pak
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
                                • Size 577KB
                                • SHA256 76572fbc138ae74d2f2ecdb3dc8924d54f92745db7ee8eb8e8ad7dc4eb576825
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                en.mo
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
                                • Size 16KB
                                • SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                zh-Hant.mo
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
                                • Size 16KB
                                • SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                resources.pak
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
                                • Size 17.8MB
                                • SHA256 e3a6200122f362e77bee9418fec7469202c81852807f7dd70b021ed600374215
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                v8_context_snapshot.bin
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
                                • Size 16.5MB
                                • SHA256 aa24dd3365f6286af18dd73e66a368b3b62ba42fdf1853c9c30bb1dc17488a73
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vk_swiftshader.dll
                                • Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
                                • Size 5.2MB
                                • SHA256 50f422c53e00c586e163424e5f08c765094b39fe855e4fb73c1e587b3fe37e9a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                hyph-bn.hyb
                                • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6096_653076300\hyph-bn.hyb
                                • Size 703B
                                • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                hyph-mr.hyb
                                • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6096_653076300\hyph-mr.hyb
                                • Size 687B
                                • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                hyph-nn.hyb
                                • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6096_653076300\hyph-nn.hyb
                                • Size 141KB
                                • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                LICENSE
                                • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping6096_76472355\LICENSE
                                • Size 1KB
                                • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                memory/2188-647-0x000001CAFB200000-0x000001CAFDB17000-memory.dmp
                                Download

                                memory/2488-1062-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1058-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1053-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1054-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1055-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1056-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1057-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1059-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1060-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1061-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1063-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1064-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1049-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2488-1047-0x000002C5E7110000-0x000002C5E7112000-memory.dmp
                                Download

                                memory/2820-853-0x00000203EDD10000-0x00000203F0627000-memory.dmp
                                Download

                                memory/2820-841-0x00000203ED950000-0x00000203ED951000-memory.dmp
                                Download

                                memory/2820-847-0x00000203ED950000-0x00000203ED951000-memory.dmp
                                Download

                                memory/2820-851-0x00000203ED950000-0x00000203ED951000-memory.dmp
                                Download

                                memory/2820-843-0x00000203ED950000-0x00000203ED951000-memory.dmp
                                Download

                                memory/2820-850-0x00000203ED950000-0x00000203ED951000-memory.dmp
                                Download

                                memory/2820-849-0x00000203ED950000-0x00000203ED951000-memory.dmp
                                Download

                                memory/2820-852-0x00000203ED950000-0x00000203ED951000-memory.dmp
                                Download

                                memory/2820-848-0x00000203ED950000-0x00000203ED951000-memory.dmp
                                Download

                                memory/4152-743-0x0000022F48D80000-0x0000022F4B697000-memory.dmp
                                Download

                                memory/4152-718-0x0000022F48D80000-0x0000022F4B697000-memory.dmp
                                Download

                                memory/5372-931-0x0000016010000000-0x0000016012917000-memory.dmp
                                Download

                                memory/5372-872-0x0000016010000000-0x0000016012917000-memory.dmp
                                Download

                                memory/5372-789-0x0000016010000000-0x0000016012917000-memory.dmp
                                Download

                                memory/5372-644-0x0000016010000000-0x0000016012917000-memory.dmp
                                Download

                                memory/5472-400-0x00007FFB10390000-0x00007FFB10391000-memory.dmp
                                Download

                                memory/5472-399-0x00007FFB11630000-0x00007FFB11631000-memory.dmp
                                Download

                                memory/6096-339-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1105-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1103-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1145-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1065-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1009-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1183-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-978-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1201-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-950-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1223-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-341-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-932-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-889-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-855-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1407-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-808-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1425-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1440-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-790-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1478-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-759-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1496-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1518-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-725-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1556-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-717-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-716-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1600-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-673-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-662-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-1618-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-648-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-643-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download

                                memory/6096-533-0x0000019D23B90000-0x0000019D264A7000-memory.dmp
                                Download