Analysis

  • max time kernel
    900s
  • max time network
    901s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 16:28

General

  • Target
    SpotifySetup.exe
  • Size 1.0MB
  • Sample261107-tyysbses5m
  • SHA256 dc3dfb190e21a6740566b49c2dc79353fcb046c9df58128c8e2ba51b6f2e47de
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 41 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 11 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe
    "C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"
    1⤵
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of WriteProcessMemory
    PID:5208
    • C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
      SpWebInst0.exe /webinstall
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        Spotify.exe /INSTALLCOMPLETE
        3⤵
        • Adds Run key to start application
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2296
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.3.8.620 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7fffedd2e6a0,0x7fffedd2e6b0,0x7fffedd2e6c0
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5360
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=2416,i,4327047157472507715,7382302920071659254,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708989122997041 --enable-logging=handle --log-file=2904 --mojo-platform-channel-handle=2900 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Time Discovery
          PID:4252
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --metrics-shmem-handle=2232,i,16054046422685152663,4294030826026638789,262144 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708988185955192 --enable-logging=handle --log-file=2336 --mojo-platform-channel-handle=2648 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:992
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=2984,i,15090454950308845487,2929915797840427494,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708990060038890 --enable-logging=handle --log-file=3248 --mojo-platform-channel-handle=3244 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2648
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=5340,i,14185867449236173656,13225554608711196032,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708990997080739 --enable-logging=handle --log-file=3248 --mojo-platform-channel-handle=5404 /prefetch:13
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1440
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=5396,i,14859630620836707148,12529584154957011829,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708991934122588 --enable-logging=handle --log-file=4948 --mojo-platform-channel-handle=4952 /prefetch:11
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Time Discovery
          PID:5872
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --top-chrome-webui --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=5852,i,4426645718835019794,7446701358275616073,2097152 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708992871164437 --enable-logging=handle --log-file=5860 --mojo-platform-channel-handle=5856 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1824
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --enable-blink-features=DocumentPictureInPictureCefOptions --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=6300,i,8252358215927457181,9091277241527527494,2097152 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708994745248135 --enable-logging=handle --log-file=6316 --mojo-platform-channel-handle=6312 /prefetch:1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4184
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=7620,i,14436437657693481664,3271260858867367355,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708995682289984 --enable-logging=handle --log-file=8056 --mojo-platform-channel-handle=8052 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          PID:4976
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=6808,i,15769900715494482015,6041891511637499035,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708996619331833 --enable-logging=handle --log-file=3876 --mojo-platform-channel-handle=7524 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4716
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=2204,i,12192312864475701129,8633296437539786626,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708997556373682 --enable-logging=handle --log-file=3860 --mojo-platform-channel-handle=7472 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3512
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=7352,i,12475859535452955105,4495990030474202205,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708998493415531 --enable-logging=handle --log-file=7356 --mojo-platform-channel-handle=7284 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3720
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=4060,i,15361355752955187750,15106357834834110900,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190708999430457380 --enable-logging=handle --log-file=4012 --mojo-platform-channel-handle=4008 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4592
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=7364,i,9827430855132876612,8709078241835774912,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709000367499229 --enable-logging=handle --log-file=3852 --mojo-platform-channel-handle=3956 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5976
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=3852,i,8149594693832686902,2269868079361505676,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709001304541078 --enable-logging=handle --log-file=8236 --mojo-platform-channel-handle=1880 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1008
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=7280,i,10643409280589895969,10915118876976035156,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709002241582927 --enable-logging=handle --log-file=8248 --mojo-platform-channel-handle=4036 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4140
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=7456,i,7876145396097635432,7040485358874521309,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709003178624776 --enable-logging=handle --log-file=7380 --mojo-platform-channel-handle=7392 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2100
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=6020,i,1498960037366405364,54608033105645129,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709004115666625 --enable-logging=handle --log-file=2476 --mojo-platform-channel-handle=8120 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2248
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=2108,i,1790166655332950175,8445789639601379047,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709005052708474 --enable-logging=handle --log-file=5652 --mojo-platform-channel-handle=8064 /prefetch:14
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5464
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-gpu-sandbox --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --start-stack-profiler --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --gpu-preferences=WAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=d3d11-warp-webgl --metrics-shmem-handle=2480,i,807893158871147954,10702144152981438497,262144 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709005989750323 --enable-logging=handle --log-file=3852 --mojo-platform-channel-handle=8236 /prefetch:10
          4⤵
          • Network Service Discovery
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:5520
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=7116,i,15648720298839442381,6569040328952205315,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709006926792172 --enable-logging=handle --log-file=7532 --mojo-platform-channel-handle=7360 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:3440
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=4936,i,8617257523543458107,7899823999254413185,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709007863834021 --enable-logging=handle --log-file=7464 --mojo-platform-channel-handle=8088 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:4732
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=6996,i,8137787561252374926,5497544512282844544,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709008800875870 --enable-logging=handle --log-file=7440 --mojo-platform-channel-handle=6988 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:3240
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=3952,i,16624875050544611051,9539376906328273767,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709009737917719 --enable-logging=handle --log-file=8244 --mojo-platform-channel-handle=5244 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:4320
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=4032,i,6377763800654775116,5223174745484017677,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709010674959568 --enable-logging=handle --log-file=4936 --mojo-platform-channel-handle=1880 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:5800
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=7428,i,6772401043934646788,2531142960083056428,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709011612001417 --enable-logging=handle --log-file=7456 --mojo-platform-channel-handle=8244 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:4052
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=7588,i,4341578631334770215,16043014516503690926,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709012549043266 --enable-logging=handle --log-file=7536 --mojo-platform-channel-handle=7456 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:5968
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=8120,i,6636946387680681362,17919759954126771133,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709013486085115 --enable-logging=handle --log-file=7396 --mojo-platform-channel-handle=7324 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:3264
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=7428,i,8970006667147427216,1346392658068650281,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709014423126964 --enable-logging=handle --log-file=2480 --mojo-platform-channel-handle=4748 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:3516
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=2108,i,13920022350715578483,9121559444432447214,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709015360168813 --enable-logging=handle --log-file=8244 --mojo-platform-channel-handle=7452 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:5200
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=8248,i,18407861392594678151,7115247670848451397,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709016297210662 --enable-logging=handle --log-file=2104 --mojo-platform-channel-handle=2108 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:3288
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=2476,i,17577384770230821984,1765923971870754114,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709017234252511 --enable-logging=handle --log-file=7392 --mojo-platform-channel-handle=8108 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:596
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=7360,i,2008573675008166990,10060086436755749023,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709018171294360 --enable-logging=handle --log-file=4744 --mojo-platform-channel-handle=7464 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:2036
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=3848,i,18343504011923967778,13830616862964696377,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709019108336209 --enable-logging=handle --log-file=3956 --mojo-platform-channel-handle=7624 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:3992
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=1804,i,15080780246074798029,5710436175005357079,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709020045378058 --enable-logging=handle --log-file=7536 --mojo-platform-channel-handle=7276 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:5928
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=3852,i,14952174223011255836,8145886935636799946,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709020982419907 --enable-logging=handle --log-file=7276 --mojo-platform-channel-handle=8100 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:4332
        • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
          "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --log-severity=disable --user-agent-product="Chrome/151.0.7922.138 Spotify/1.3.8.620" --metrics-shmem-handle=1884,i,784972595233524500,9424941587168508112,524288 --field-trial-handle=2652,i,16501954737609540278,1554344362988056625,262144 --disable-features=AutofillActorMode,BackForwardCache,FullscreenBubbleShowOrigin,GlicActorUi,HardwareMediaKeyHandling,KillOnInvalidNavigationHeaders,LensOverlay,PartitionAllocDanglingPtr,PartitionAllocUnretainedDanglingPtr,StorageNotificationService --variations-seed-version --pseudonymization-salt-handle=2656,i,9997992918383538806,11272773861217218175,4 --trace-process-track-uuid=3190709021919461756 --enable-logging=handle --log-file=6988 --mojo-platform-channel-handle=5244 /prefetch:14
          4⤵
          • Executes dropped EXE
          PID:4308
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
    1⤵
      PID:3460
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
      1⤵
      • Modifies data under HKEY_USERS
      PID:1764
    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --autostart --minimized
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3324
      • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
        C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.3.8.620 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7fffedd2e6a0,0x7fffedd2e6b0,0x7fffedd2e6c0
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2580
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:5156
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:4192

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              0faf08fb-fcc0-49e8-be56-dc47ba7dcb40.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\0faf08fb-fcc0-49e8-be56-dc47ba7dcb40.tmp
              • Size 6KB
              • SHA256 f4f079410ced73252c45057b80528e87a8df5f69bf1b161cf3a1e7df1d327b6d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              2282ea15-eb6c-440c-b919-7099f15cb378.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\2282ea15-eb6c-440c-b919-7099f15cb378.tmp
              • Size 6KB
              • SHA256 debbfe50869476be87c3597009f07dc28de2bff88932bcaa92a1c7ba69517dc1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              45fec8d6-b5e6-42af-9e88-0b61d04951f8.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\45fec8d6-b5e6-42af-9e88-0b61d04951f8.tmp
              • Size 6KB
              • SHA256 5d49ee590626f0b44e744f2d6673a15303913bd5697f6b1a7b7ddfc1bb644ff6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              4a2292f9-3ab6-4c4c-a127-ac5deac32335.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\4a2292f9-3ab6-4c4c-a127-ac5deac32335.tmp
              • Size 6KB
              • SHA256 ce658f77e109f6639dd1776a62629a6c9c17f40cad840a44f8d2d89ef11b452f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              5c22a9c7-6db9-440b-b129-296efb8e817c.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\5c22a9c7-6db9-440b-b129-296efb8e817c.tmp
              • Size 2KB
              • SHA256 a296fa8d92b2256db34a1d74f389a7fabea31a9f2e0bf9d830e1b10452e3a3fc
              • MD5 SHA1 SHA512 TLSH

              8dc9e43f-dcdd-4b45-ab2d-3cb27b5638bd.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\8dc9e43f-dcdd-4b45-ab2d-3cb27b5638bd.tmp
              • Size 6KB
              • SHA256 fa63bed4c650e5929af16d5bcd408de0e27907b9e9aa8cbe4172b3d942a2122c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              1a249541-8881-4f6c-b706-96c6ad47b28f.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\1a249541-8881-4f6c-b706-96c6ad47b28f.tmp
              • Size 6B
              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
              • MD5 SHA1 SHA512

              56fd7e21-ee7e-4b0d-922e-e1628ba1ab36.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\56fd7e21-ee7e-4b0d-922e-e1628ba1ab36.tmp
              • Size 11KB
              • SHA256 fd06bbc3695955f47e83539785a01e82a8786c7c56dd032a9f09182b5d57e2c6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              70ec5be1-3c97-43d3-99e9-346dec56cd17.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\70ec5be1-3c97-43d3-99e9-346dec56cd17.tmp
              • Size 11KB
              • SHA256 8b244069f0b7d1f5d41044ab9581da29ce3059a640db33f30e1a1ec3fdc08681
              • MD5 SHA1 SHA512 SSDEEP TLSH

              snapshot-new.baf

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Cache\No_Vary_Search\snapshot-new.baf
              • Size 20B
              • SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
              • MD5 SHA1 SHA512

              index

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index
              • Size 24B
              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
              • MD5 SHA1 SHA512

              temp-index

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\temp-index
              • Size 72B
              • SHA256 e84a4e8b0d4fa1417b638723d62f815217683e4e7c96e5ac1f4d87d1354019fa
              • MD5 SHA1 SHA512 TLSH

              the-real-index

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index
              • Size 48B
              • SHA256 98868a1a356f74f6e5a1b8cc84e8b3c3d79e106f74ed603de8a1423ec3113627
              • MD5 SHA1 SHA512

              data_0

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_0
              • Size 8KB
              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
              • MD5 SHA1 SHA512 SSDEEP

              data_1

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_1
              • Size 264KB
              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
              • MD5 SHA1 SHA512 SSDEEP

              data_2

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_2
              • Size 8KB
              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
              • MD5 SHA1 SHA512 SSDEEP

              data_3

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\DawnWebGPUCache\data_3
              • Size 8KB
              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
              • MD5 SHA1 SHA512 SSDEEP

              1502a34f-17f0-419c-b1c9-bb360a55693c.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\1502a34f-17f0-419c-b1c9-bb360a55693c.tmp
              • Size 2KB
              • SHA256 0ad9ad1f5bd9ed68130554c9e60cd9579d7e58844b287fb880cf71fa1be22f1d
              • MD5 SHA1 SHA512 TLSH

              dc649666-fbd9-4945-b954-288b5c32fa3d.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Network\dc649666-fbd9-4945-b954-288b5c32fa3d.tmp
              • Size 59B
              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
              • MD5 SHA1 SHA512 TLSH

              Preferences

              • Path C:\Users\Admin\AppData\Local\Spotify\Browser\Preferences
              • Size 10KB
              • SHA256 411789c22ae7096b2961f4c8cb5e483cf0eaed38d197663ff64a693426944a82
              • MD5 SHA1 SHA512 SSDEEP TLSH

              43b114b0-14d9-4771-8913-f4c08a0b2b4c.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\Default\43b114b0-14d9-4771-8913-f4c08a0b2b4c.tmp
              • Size 10KB
              • SHA256 994e8de54055159169d8c929bb0fb5707f3d195c5bf3e96de98addc3a73f5698
              • MD5 SHA1 SHA512 SSDEEP TLSH

              4ef56425-8821-44a9-bfa5-9e106a3ed8b4.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\Default\4ef56425-8821-44a9-bfa5-9e106a3ed8b4.tmp
              • Size 9KB
              • SHA256 0500f09b9f099962b563a6e28a97ab3b4a445b6660f4c063728d02659ced783e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              95f083af-82de-4320-a61a-a0bde8ee8656.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\Default\95f083af-82de-4320-a61a-a0bde8ee8656.tmp
              • Size 9KB
              • SHA256 c75bb667e729fc6cc64d490fbad2843ba34f65c2cdd697524adb55eb8dfa3647
              • MD5 SHA1 SHA512 SSDEEP TLSH

              MANIFEST-000001

              • Path C:\Users\Admin\AppData\Local\Spotify\Default\Extension Rules\MANIFEST-000001
              • Size 41B
              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
              • MD5 SHA1 SHA512

              2b5cdf11-3813-4276-8022-80f3b527ff87.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\2b5cdf11-3813-4276-8022-80f3b527ff87.tmp
              • Size 1KB
              • SHA256 ee6101d33f2d751bac9d2bada55f8dab093de3be931c62c6a4172f7e3c790f74
              • MD5 SHA1 SHA512 TLSH

              SCT Auditing Pending Reports

              • Path C:\Users\Admin\AppData\Local\Spotify\Default\Network\SCT Auditing Pending Reports
              • Size 2B
              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
              • MD5 SHA1 SHA512

              Preferences

              • Path C:\Users\Admin\AppData\Local\Spotify\Default\Preferences
              • Size 8KB
              • SHA256 8b6fd7a29b1097e5cad8c788e076b002b96188f75200aa61f1a2c3026d998c77
              • MD5 SHA1 SHA512 SSDEEP TLSH

              CURRENT

              • Path C:\Users\Admin\AppData\Local\Spotify\Default\Sync Data\LevelDB\CURRENT
              • Size 16B
              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
              • MD5 SHA1 SHA512

              cb9fead5-118f-4ba8-a665-c2ccd1e3d185.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\Default\cb9fead5-118f-4ba8-a665-c2ccd1e3d185.tmp
              • Size 84B
              • SHA256 b87bf305aafae1f1ec7dd947176c9529b2a9cbd4a3bf296fce25fc009e725366
              • MD5 SHA1 SHA512 TLSH

              Local State

              • Path C:\Users\Admin\AppData\Local\Spotify\Local State
              • Size 917B
              • SHA256 bcaa1e3da7b6edec5a065333ccecdb70448d663b865a220ccd84d135abd0071f
              • MD5 SHA1 SHA512 TLSH

              Local State

              • Path C:\Users\Admin\AppData\Local\Spotify\Local State
              • Size 6KB
              • SHA256 233166ef39b07065c91dd2678ce26197b0436f77b62e2f553f1e3a66b3a2d8d8
              • MD5 SHA1 SHA512 SSDEEP TLSH

              settings.dat

              • Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
              • Size 56B
              • SHA256 3baaf0257a0beb1cc32735c8ad420876e0f283fc436973b6b5dced96c1b19b8c
              • MD5 SHA1 SHA512

              b0944768-faf8-48b2-8b61-0e89ea43f8d1.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\b0944768-faf8-48b2-8b61-0e89ea43f8d1.tmp
              • Size 6KB
              • SHA256 7e1b0f5816b627b8c08738c0f2dc5171104107be55cb10c2618c40ff5e559839
              • MD5 SHA1 SHA512 SSDEEP TLSH

              b5247ddc-a0d5-4094-9f58-423a4baa41d0.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\b5247ddc-a0d5-4094-9f58-423a4baa41d0.tmp
              • Size 6KB
              • SHA256 ce678d9eb0137609d28220c8ecb5951bb20d9be39f03be177e451fde8f60f6a7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              cadf892f-dcce-4635-938a-af6717032c50.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\cadf892f-dcce-4635-938a-af6717032c50.tmp
              • Size 3KB
              • SHA256 5abb208ad014e37739ea91b64029c8e22c87bd93451a3af865235589ce4ac3ad
              • MD5 SHA1 SHA512 TLSH

              025d8f88-64fc-4550-9885-f81c5b9bf208.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\025d8f88-64fc-4550-9885-f81c5b9bf208.tmp
              • Size 2KB
              • SHA256 7c181d26e4bceb6565f4ba2fd7e695faeb7d3998a06e099b0535bc9f20183ce0
              • MD5 SHA1 SHA512 TLSH

              0d697392-10e9-44f8-9a97-3226a148e759.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\0d697392-10e9-44f8-9a97-3226a148e759.tmp
              • Size 1KB
              • SHA256 b4eb370811dbf15808b7e6cf3a021a973c2e3d77f70a57f6813a405a7b738ea7
              • MD5 SHA1 SHA512 TLSH

              0eb9a938-0a47-4ade-9bb3-d3fcb5abf64d.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\0eb9a938-0a47-4ade-9bb3-d3fcb5abf64d.tmp
              • Size 908B
              • SHA256 5002b57d5b2ab2dd8de2e866bd66a70c3055ee2cad609439e4d3301ca3aede35
              • MD5 SHA1 SHA512 TLSH

              1f4f5838-fe8e-4da1-89f5-2ae41fa0ce2b.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\1f4f5838-fe8e-4da1-89f5-2ae41fa0ce2b.tmp
              • Size 684B
              • SHA256 0a222b097dfe69134e99d0d3e2b7d00e8fe832cd75ec97d74186c56f9083b822
              • MD5 SHA1 SHA512 TLSH

              23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
              • Size 7.6MB
              • SHA256 23759e3f6d0119a00038b963cec9fb7abafd7b65a35a7e83c7697511db59e6e7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
              • Size 11KB
              • SHA256 261bea60d22ebca3a95ce335c03ec751a0b58b2b7bdbd6ea51dfa54381b07775
              • MD5 SHA1 SHA512 SSDEEP TLSH

              37d183b933697a62791bf4d91eef0f197685818a1d70405561412344dad3e0a9

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\37d183b933697a62791bf4d91eef0f197685818a1d70405561412344dad3e0a9
              • Size 181KB
              • SHA256 37d183b933697a62791bf4d91eef0f197685818a1d70405561412344dad3e0a9
              • MD5 SHA1 SHA512 SSDEEP TLSH

              3b1293b1cd2b0b9ebc8c64bf5c6a0407ffad78a0364bbac71c5fe7d3e1bd7657

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\3b1293b1cd2b0b9ebc8c64bf5c6a0407ffad78a0364bbac71c5fe7d3e1bd7657
              • Size 178KB
              • SHA256 3b1293b1cd2b0b9ebc8c64bf5c6a0407ffad78a0364bbac71c5fe7d3e1bd7657
              • MD5 SHA1 SHA512 SSDEEP TLSH

              456c58ab-9189-46cc-a856-6aaa123837c4.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\456c58ab-9189-46cc-a856-6aaa123837c4.tmp
              • Size 1KB
              • SHA256 fce11f1fd3d7e00190d85ba24b7b81f85338f910c2de230c04c30cd1b44a0970
              • MD5 SHA1 SHA512 TLSH

              50c50dfe552378c67888722e4bac990ba88e8a9567df853e350a22e1e0ae881a

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\50c50dfe552378c67888722e4bac990ba88e8a9567df853e350a22e1e0ae881a
              • Size 287KB
              • SHA256 50c50dfe552378c67888722e4bac990ba88e8a9567df853e350a22e1e0ae881a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              549ae2f6-3bbb-45be-a9ff-38adbd853a98.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\549ae2f6-3bbb-45be-a9ff-38adbd853a98.tmp
              • Size 1KB
              • SHA256 355daffb431c65bedcfd70b3e09c181ac666f393ac23d1cd9d3fd49a1cfb3fe9
              • MD5 SHA1 SHA512 TLSH

              5d96d2d6-dc3d-4e5c-9f1a-3ccaff857751.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\5d96d2d6-dc3d-4e5c-9f1a-3ccaff857751.tmp
              • Size 1KB
              • SHA256 322bce433fa546ad2fda5eae569be74aa50766c90a878737ca92e5d56f0787e2
              • MD5 SHA1 SHA512 TLSH

              69d41e8d-9e8e-49c1-b176-abdcc472c13b.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\69d41e8d-9e8e-49c1-b176-abdcc472c13b.tmp
              • Size 1KB
              • SHA256 0baf14b1a2ce5fb4e12770de662297dbd76465483a1836790edd9b15792d1d8f
              • MD5 SHA1 SHA512 TLSH

              7249ff72-1652-4e92-9239-7928b2c54ffe.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\7249ff72-1652-4e92-9239-7928b2c54ffe.tmp
              • Size 1KB
              • SHA256 4e2a89717aa8fcf8a27afdcbbf7b08a1c0d069d857a6eb9337d1d351d904155a
              • MD5 SHA1 SHA512 TLSH

              734f30f2-1cb8-4c31-84d2-28ec83773dda.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\734f30f2-1cb8-4c31-84d2-28ec83773dda.tmp
              • Size 1KB
              • SHA256 8ee926a386bdc1f4125fddceaed3ccf11af12a72d1b46a5c1e5038ef71f291c8
              • MD5 SHA1 SHA512 TLSH

              8c2260ff-3635-4419-8204-29b8ee4c5bd4.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\8c2260ff-3635-4419-8204-29b8ee4c5bd4.tmp
              • Size 1020B
              • SHA256 b6e79cc01c6ffbd6a6d65a03e262c5fd02e597a0eb8824abd2d8254c9789e601
              • MD5 SHA1 SHA512 TLSH

              a8829e90-e424-4100-8d1f-041db672e4d2.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\a8829e90-e424-4100-8d1f-041db672e4d2.tmp
              • Size 1KB
              • SHA256 be95db218c973c98fbe640dc3133ed50fe46df0ff395751341db5c22585cd30f
              • MD5 SHA1 SHA512 TLSH

              bbab50a2d04d1ae9ba615ed9ccf1bb91f50f947c0e888ce9af208c0d8a7a355f

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\bbab50a2d04d1ae9ba615ed9ccf1bb91f50f947c0e888ce9af208c0d8a7a355f
              • Size 24.3MB
              • SHA256 bbab50a2d04d1ae9ba615ed9ccf1bb91f50f947c0e888ce9af208c0d8a7a355f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              c1d06372335775cfd1512f62e8a0464d08f5058a6a622904f2357fb2c3aa6b09

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\c1d06372335775cfd1512f62e8a0464d08f5058a6a622904f2357fb2c3aa6b09
              • Size 2.5MB
              • SHA256 c1d06372335775cfd1512f62e8a0464d08f5058a6a622904f2357fb2c3aa6b09
              • MD5 SHA1 SHA512 SSDEEP TLSH

              c8e95761-8050-4b07-b52b-b4d18ee442fc.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\c8e95761-8050-4b07-b52b-b4d18ee442fc.tmp
              • Size 572B
              • SHA256 5b2fb47c9b9b20bd58301294dd10a985f754498a7d1c308c2356ae6546f8f3cc
              • MD5 SHA1 SHA512 TLSH

              cd397ac3-58b7-4c23-be4f-3061a0678a6a.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\cd397ac3-58b7-4c23-be4f-3061a0678a6a.tmp
              • Size 1KB
              • SHA256 64573eac0b7d6356bb0f6877f919ffca0c1f4ddb775de17aebf83cccd631f262
              • MD5 SHA1 SHA512 TLSH

              d70dd665-8e93-4275-9203-185fc18f5120.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\d70dd665-8e93-4275-9203-185fc18f5120.tmp
              • Size 348B
              • SHA256 5bd72002f4a35c04eb194892d7c888726143b26c79a86006ac81584b2aea8319
              • MD5 SHA1 SHA512 TLSH

              ecc813a9-1d6f-4940-aba5-cc5085467dce.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\ecc813a9-1d6f-4940-aba5-cc5085467dce.tmp
              • Size 796B
              • SHA256 3f424040c484d761aefdc95356f19db2b78bc1a03f6c5700750e5cc3e8eb199b
              • MD5 SHA1 SHA512 TLSH

              f3b18ea7-e273-48e0-8bec-9b311a285912.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\f3b18ea7-e273-48e0-8bec-9b311a285912.tmp
              • Size 460B
              • SHA256 ea1731ff532007af49a7a1933daa59c957ed2a0dbdec157c88316aa110ab759e
              • MD5 SHA1 SHA512 TLSH

              fb48487f-3360-4ac5-8e47-091f4b0788ce.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\component_crx_cache\fb48487f-3360-4ac5-8e47-091f4b0788ce.tmp
              • Size 124B
              • SHA256 418e37a64c865013c87c6d30e5094d292fa74fb46e449d968ac83f492e46407b
              • MD5 SHA1 SHA512 TLSH

              b1b95b5a-e125-4b0f-b2e0-83e0b8f0f63a.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\extensions_crx_cache\b1b95b5a-e125-4b0f-b2e0-83e0b8f0f63a.tmp
              • Size 13B
              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
              • MD5 SHA1 SHA512

              f9829871-0025-4e19-ad28-160256fcc089.tmp

              • Path C:\Users\Admin\AppData\Local\Spotify\f9829871-0025-4e19-ad28-160256fcc089.tmp
              • Size 6KB
              • SHA256 cef30c96aa0b8b9a3b5e16ef3fc438d408e751f917527cadd0e954b9e58a3cc6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              000002.dbtmp

              • Path C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp
              • Size 16B
              • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
              • MD5 SHA1 SHA512

              login.spa

              • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa
              • Size 6.5MB
              • SHA256 0a34fa94b30b32f70b8414648a3ad5b96acd056b5f42f7646c9c7520fe1d9629
              • MD5 SHA1 SHA512 SSDEEP TLSH

              native-licenses.html

              • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\native-licenses.html
              • Size 69KB
              • SHA256 60b3815397a51219706faf8dc6553c8c13b59f2fe023221d41e077c9faa35d80
              • MD5 SHA1 SHA512 SSDEEP TLSH

              xpui.spa

              • Path C:\Users\Admin\AppData\Roaming\Spotify\Apps\xpui.spa
              • Size 11.7MB
              • SHA256 df55f5231758411a3ea6d9b47dfa8e47d3b1dbfd9d50e5d75c2b601218c71824
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Spotify.dll

              • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll
              • Size 42.1MB
              • SHA256 769ac5a1a282f470b663a1c3933774f56d954f8f0dbfd156f9d799a173c79406
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Spotify.dll.sig

              • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.dll.sig
              • Size 1KB
              • SHA256 ae1b8cde7257bcbd928a73bbf3bdcfd1bc71f43c75f8ae0a0af3ca19a9b679d8
              • MD5 SHA1 SHA512 TLSH

              Spotify.exe

              • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
              • Size 3.8MB
              • SHA256 d3871b833e6a54382ca500b316d14b83b22b8ee16b594e8414e3f2c2dfc1a541
              • MD5 SHA1 SHA512 SSDEEP TLSH

              Spotify.exe.sig

              • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe.sig
              • Size 1KB
              • SHA256 cfff90fdd5fa035c2c2948d8fb04c1127052014831c192dd399f658555e8db8c
              • MD5 SHA1 SHA512 TLSH

              SpotifyLauncher.exe

              • Path C:\Users\Admin\AppData\Roaming\Spotify\SpotifyLauncher.exe
              • Size 10.0MB
              • SHA256 e67ef132070c63f5c56e7b7d0d5d72e86e208576432bfc6fc69fd1821ef06513
              • MD5 SHA1 SHA512 SSDEEP TLSH

              chrome_100_percent.pak

              • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak
              • Size 689KB
              • SHA256 9a9cee828a46b2b3ab96bc6907493fb5ee6cb23da2239ee92ae4d7f18bf4d130
              • MD5 SHA1 SHA512 SSDEEP TLSH

              chrome_200_percent.pak

              • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak
              • Size 1.2MB
              • SHA256 4500aa1043a4edcd12c2c524ae0ab43f4c482f7280e3a850d94e1aa1860d34e2
              • MD5 SHA1 SHA512 SSDEEP TLSH

              chrome_elf.dll

              • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
              • Size 2.7MB
              • SHA256 77fc2baa79ce4c5f55f2ce7e673e464ccbb9a7493a850a32da5a33b0b5b88029
              • MD5 SHA1 SHA512 SSDEEP TLSH

              crash_reporter.cfg

              • Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
              • Size 631B
              • SHA256 2a3530dc489d67ebac2ca00a7f7777eb29cf2f1e2232c6a3e96e543c029d20ac
              • MD5 SHA1 SHA512 TLSH

              crashpad_handler.exe

              • Path C:\Users\Admin\AppData\Roaming\Spotify\crashpad_handler.exe
              • Size 773KB
              • SHA256 16298d6a30d97b98fdf8d014295bff3fbf8fb58279112ad8dca8533790919969
              • MD5 SHA1 SHA512 SSDEEP TLSH

              d3dcompiler_47.dll

              • Path C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll
              • Size 4.5MB
              • SHA256 7ad8dfec0ba97678b5b10fd53bd54b37a26413a2239bf6215931c20076789de0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              icudtl.dat

              • Path C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat
              • Size 10.4MB
              • SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
              • MD5 SHA1 SHA512 SSDEEP TLSH

              libEGL.dll

              • Path C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll
              • Size 460KB
              • SHA256 97817723f89a82409d7b1b9b5ede5e759e3d182c30a78bfd89cd526fd23e991f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              libGLESv2.dll

              • Path C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll
              • Size 460KB
              • SHA256 d72b51c8fa1ea4d693a903046b29d2e13e74ffd6f5edac2318db8f916a977216
              • MD5 SHA1 SHA512 SSDEEP TLSH

              libcef.dll.sig

              • Path C:\Users\Admin\AppData\Roaming\Spotify\libcef.dll.sig
              • Size 1KB
              • SHA256 9487c116af0ee4205d62f675b6373fa396788159b519bca2b2577da25d18342f
              • MD5 SHA1 SHA512 TLSH

              af.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\af.mo
              • Size 16KB
              • SHA256 f18151982b11edf6460b02b6cf7bd5d104fe5cfb7252dcac40247ced81326e40
              • MD5 SHA1 SHA512 SSDEEP TLSH

              am.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\am.mo
              • Size 20KB
              • SHA256 8fd30c72089b6afccd9b53a69fec02df84f01fbc112502534d483a288239056e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ar-EG.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ar-EG.mo
              • Size 20KB
              • SHA256 6db052b3510c4d4c53f9262a17ec7dc9230fadb8e6b61fa13e02230680ee7988
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ar-MA.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ar-MA.mo
              • Size 20KB
              • SHA256 aa85d032dd43e35aac0a302efdafef240f8f16a197aa9d333dab62ad7630d122
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ar-SA.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ar-SA.mo
              • Size 20KB
              • SHA256 44c801b550b67c6b564066a2e1a943255ee207f8c49dc06427355e03a9aee4bc
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ar.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ar.mo
              • Size 20KB
              • SHA256 a7b998f51750f4b06489894af6af9141601a344c5fd73a79ce88a5e05bf4cd08
              • MD5 SHA1 SHA512 SSDEEP TLSH

              az.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\az.mo
              • Size 18KB
              • SHA256 f6fb69412508d19c32ce514be79334131264e4ce17fabe0409e0b8245a7cb678
              • MD5 SHA1 SHA512 SSDEEP TLSH

              bg.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\bg.mo
              • Size 22KB
              • SHA256 6fcf6c7033be5ef5afdc1dd499eafb6f850f727ccab6bc7ba9a3e03ede3150c7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              bho.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\bho.mo
              • Size 24KB
              • SHA256 d215066d1da8189454b476a68ed4dd67cd956c68ecaf49a83ea865e9f272fac4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              bn.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\bn.mo
              • Size 25KB
              • SHA256 1a5d5e200811988cc74ecc389c1fe24c33a48a543adc87a6f1c6fc8cb34e637e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              bs.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\bs.mo
              • Size 17KB
              • SHA256 83e099dbc0022f6f2c723f701cff4feb688954ed5a0cca8e214c16b0346eda13
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ca.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ca.mo
              • Size 17KB
              • SHA256 0f35a77ae28ff5e148ea122780f1006aa5111da6235416a2fc7ed0c215175a66
              • MD5 SHA1 SHA512 SSDEEP TLSH

              cs.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\cs.mo
              • Size 17KB
              • SHA256 0ce5ca17a46a31ccd37aafb145133a6f4e6606087ec7c9357d357aa6903ba5de
              • MD5 SHA1 SHA512 SSDEEP TLSH

              da.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\da.mo
              • Size 17KB
              • SHA256 a5f88cc25a829a26de482cd4b4d28c44277c70981fbb0050a54cd4f437fb713e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              de.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\de.mo
              • Size 17KB
              • SHA256 ab6b48450a35f81726e61bbbbcac152b1f029a2a524c7e4829042439e5d37f1e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              el.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\el.mo
              • Size 23KB
              • SHA256 8bd6f8d94ab6b5a0c1dd19f247e381a85c887168f4b118c954203adbf5a08904
              • MD5 SHA1 SHA512 SSDEEP TLSH

              en-GB.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-GB.mo
              • Size 16KB
              • SHA256 dcd7b66a1c2bd622958a873c4b42ef925019a3f9b8d4710f9145db71409bf628
              • MD5 SHA1 SHA512 SSDEEP TLSH

              en-US.pak

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak
              • Size 581KB
              • SHA256 0b2a72cc851d62f615080f3954f2c94d7009ccac31ac4248398f08359fd1c714
              • MD5 SHA1 SHA512 SSDEEP TLSH

              en.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo
              • Size 16KB
              • SHA256 ea9d1bcb4a56f14a2fe7e4b214e3826c4619e6abe55cc90f42b6af579c06d83b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              es-419.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\es-419.mo
              • Size 17KB
              • SHA256 8ef4238202014096cf738dd3ee3113adca63944cdd191cd8464a0b2031625b2e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              es-AR.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\es-AR.mo
              • Size 17KB
              • SHA256 c32c177a1aed5a15a4bcd07dd4dc3db74c45682ffaf6a1c8a45393142890a6c7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              es-MX.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\es-MX.mo
              • Size 17KB
              • SHA256 404759a8fbb728729692747ac19f6b6953bc0632bbbca753b24771f1a653eb78
              • MD5 SHA1 SHA512 SSDEEP TLSH

              es.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\es.mo
              • Size 17KB
              • SHA256 c468a03f6e45046fc9fd8a5133091fb72ed66587627662cfac61632b11955365
              • MD5 SHA1 SHA512 SSDEEP TLSH

              et.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\et.mo
              • Size 17KB
              • SHA256 992981edc15070a0adf225e205ee7ccfb2ec0b8ee0c1a743a0c0c51cf152d133
              • MD5 SHA1 SHA512 SSDEEP TLSH

              eu.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\eu.mo
              • Size 17KB
              • SHA256 68ef4b89672fa1ff7b1ba29304af3792411c22968a43e09012358b45ce9d4048
              • MD5 SHA1 SHA512 SSDEEP TLSH

              fa.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\fa.mo
              • Size 21KB
              • SHA256 bd60dd37e15d89125e818f0b0abc31a721858cd9e458f449ffa6457cbe42ace6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              fi.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\fi.mo
              • Size 17KB
              • SHA256 7682322d3bcb60af4c031f112408f40d183856cba9ef98a68e96ca600d0f8c6b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              fil.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\fil.mo
              • Size 17KB
              • SHA256 5a0290abda7f56cfebc1404f72c56a2bf1075bd453a087b31597cd40c1b059bb
              • MD5 SHA1 SHA512 SSDEEP TLSH

              fr-CA.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\fr-CA.mo
              • Size 18KB
              • SHA256 faaffc93e48d90e466197879b3637782f926fe1a6948df0f648420bdd802dc81
              • MD5 SHA1 SHA512 SSDEEP TLSH

              fr.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\fr.mo
              • Size 18KB
              • SHA256 10d0030baefa37c09c8e73d7484c679179ff1ef71622130fb57c246ea088fa8d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              gl.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\gl.mo
              • Size 17KB
              • SHA256 baefb0f5a3551b79b0325b6b424171bbad91af8faadf2bc50bc43b52aaa9f4b6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              gu.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\gu.mo
              • Size 24KB
              • SHA256 ea34bf5f0f465fe070c08c7d6f056e12218314ba6931c944722a32aa45fd54c4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              he.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\he.mo
              • Size 19KB
              • SHA256 93644d11e66b4ff522c962dee76b50b85ff52577420e32fc349975f00310d6e1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              hi.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\hi.mo
              • Size 26KB
              • SHA256 852bfde3a31c889f7d8e178435fc62bfdd543fbb8b70b19f52895ce21ab84993
              • MD5 SHA1 SHA512 SSDEEP TLSH

              hr.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\hr.mo
              • Size 17KB
              • SHA256 66d38ac83c3ea2e6dd60e5c063975929a9d00210999e4eaddaec94bedeb7b1cc
              • MD5 SHA1 SHA512 SSDEEP TLSH

              hu.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\hu.mo
              • Size 17KB
              • SHA256 c3dddf2942f1855edb6bfa75885667a6eb62834666ca45f4d34f8bd95886f588
              • MD5 SHA1 SHA512 SSDEEP TLSH

              id.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\id.mo
              • Size 16KB
              • SHA256 6a2677f7d60e65724d83030a601926c2746bfc241653fa4eaa29ac6673099dae
              • MD5 SHA1 SHA512 SSDEEP TLSH

              is.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\is.mo
              • Size 17KB
              • SHA256 100467f3f0ef062dbd4f5f34c3c0a56d496d72e540752566071abc9601c20e84
              • MD5 SHA1 SHA512 SSDEEP TLSH

              it.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\it.mo
              • Size 17KB
              • SHA256 c0e5ca3aad3919b6978e011982fb4bee5283859e2b5acb7c5975b900c709cf40
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ja.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ja.mo
              • Size 19KB
              • SHA256 dfaa0336098aa906290abf6ed953557dd0448fccf0a74788fb01b2d5c3059b0c
              • MD5 SHA1 SHA512 SSDEEP TLSH

              kn.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\kn.mo
              • Size 28KB
              • SHA256 970af1faaa1262aae785eee576b0e09d6d2dc3fb392f7fb605f646318fc0e55a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ko.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ko.mo
              • Size 18KB
              • SHA256 55e5dd04a8ae2b911d376fd2d72d580f7a9a2185e30915dba0685c12504c6db8
              • MD5 SHA1 SHA512 SSDEEP TLSH

              lt.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\lt.mo
              • Size 17KB
              • SHA256 1ef22194265acef812b0889c870cab49f92dab94d49ccc803f126e13dce96d6b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              lv.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\lv.mo
              • Size 17KB
              • SHA256 ce7a90b21f9059e18329fcb1fa1cff500fae0cfa94756eb6f6e59b728681d546
              • MD5 SHA1 SHA512 SSDEEP TLSH

              mk.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\mk.mo
              • Size 22KB
              • SHA256 a9c24356d771d2c270d426bf36a7ff858c3eb6cd358419c5b38e3500b24e061f
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ml.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ml.mo
              • Size 29KB
              • SHA256 2a2bc7ab6241ce637716ed05f650788c509d93a34740963f03952f04d5a33a43
              • MD5 SHA1 SHA512 SSDEEP TLSH

              mr.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\mr.mo
              • Size 25KB
              • SHA256 e090f2e7a8124d1b7839edf6482f83a535793e89cdc1d6ec3f2eb55eb129e493
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ms.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ms.mo
              • Size 17KB
              • SHA256 055923e4e1c507d778fefc5c248e0f4593b4dff9d6b7c30ce2cd0f438fddbb53
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nb.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\nb.mo
              • Size 17KB
              • SHA256 4a933878ea384fb136af8915bf8488c1b1754a461f9de6f3d7558519ea7e253b
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ne.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ne.mo
              • Size 28KB
              • SHA256 c5bd621fece94dfa802c133868f74d85fb5c95799ad949cc578569f755626161
              • MD5 SHA1 SHA512 SSDEEP TLSH

              nl.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\nl.mo
              • Size 17KB
              • SHA256 6a092b51e8ce0ba869481782ab4c548b55fc6d550fa1b4eda19b8afdb47ed9ae
              • MD5 SHA1 SHA512 SSDEEP TLSH

              or.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\or.mo
              • Size 27KB
              • SHA256 3e807bfc804aab725a9f88d2caa86d917360041ad5a993631fe6a570eaa22265
              • MD5 SHA1 SHA512 SSDEEP TLSH

              pa-IN.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\pa-IN.mo
              • Size 26KB
              • SHA256 bf690802a3757be141a674b34c8967a674ccd10f91b0299b8c7a3d8d6ecae534
              • MD5 SHA1 SHA512 SSDEEP TLSH

              pa-PK.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\pa-PK.mo
              • Size 21KB
              • SHA256 18d087b611c1883a02f0c5a8117c854302c7dfef292515ae28dd5142206112d1
              • MD5 SHA1 SHA512 SSDEEP TLSH

              pl.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\pl.mo
              • Size 17KB
              • SHA256 ff8900015a1983dd15c35d2cae6df6c8716012a557047b2943f2ed08f19d888e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              pt-BR.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\pt-BR.mo
              • Size 17KB
              • SHA256 6310dfc349c2db20df4c93ed86439429def3bf01019526fd4682997d9a19f01d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              pt-PT.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\pt-PT.mo
              • Size 17KB
              • SHA256 cc1b911b168a4ad38d419d26843872321aa44f096fe020348d1bf0dee41b8d40
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ro.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ro.mo
              • Size 17KB
              • SHA256 4fd3602488177d1d39be69120c6e7a5352349ca4a282dd8834aa6ac309e57245
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ru.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ru.mo
              • Size 21KB
              • SHA256 cec81ef9647f837743383ebbdac866e3f1d76ed7a77a818a7e1760ecaae7b8df
              • MD5 SHA1 SHA512 SSDEEP TLSH

              sk.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\sk.mo
              • Size 17KB
              • SHA256 35c40027d73a72ed32a026e8dcdf7ac8591a6eb71c8ebcb32e0264631a7a71e7
              • MD5 SHA1 SHA512 SSDEEP TLSH

              sl.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\sl.mo
              • Size 17KB
              • SHA256 c1c082b3a57466b9165232ca6bff7034079e42d745e18e28281ef0fa62c788a6
              • MD5 SHA1 SHA512 SSDEEP TLSH

              sr.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\sr.mo
              • Size 17KB
              • SHA256 b67e1aabc65f611e2c4767119e49c5183ef7d26e4b31cdf84b64ca3ccc3d1c86
              • MD5 SHA1 SHA512 SSDEEP TLSH

              sv.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\sv.mo
              • Size 17KB
              • SHA256 c8058e86431e6844e606199c0387191ecac3b9e4d53c1704f6a966c53153cff2
              • MD5 SHA1 SHA512 SSDEEP TLSH

              sw.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\sw.mo
              • Size 17KB
              • SHA256 b2a616914dd7fb9749046c8cd83ffdf0be18d81f852d1737f7a9d1a315e23eae
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ta.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ta.mo
              • Size 27KB
              • SHA256 ae2026281836070e26b3e6b52de8f0e1fc82d6b3c01ff59bc71ba4757ccf99bf
              • MD5 SHA1 SHA512 SSDEEP TLSH

              te.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\te.mo
              • Size 26KB
              • SHA256 6110e356b38956dc33116bc69b4e234aa39322b90aa3fa595bd00c758a9df535
              • MD5 SHA1 SHA512 SSDEEP TLSH

              th.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\th.mo
              • Size 24KB
              • SHA256 b1d021b7581d00c2edaa3c99e70ca9ae4fe3065a2a489ae864ebfb130f62e6cd
              • MD5 SHA1 SHA512 SSDEEP TLSH

              tr.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\tr.mo
              • Size 17KB
              • SHA256 2cdc4e310744e42a699619f8750ec04fc2ca29afc66dd3e02c57a031d8774a8e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              uk.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\uk.mo
              • Size 21KB
              • SHA256 da1a7137983d24e09f53f440bd0d44456fd8fa44006f4b5461e98b6a7cfc3f36
              • MD5 SHA1 SHA512 SSDEEP TLSH

              ur.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\ur.mo
              • Size 21KB
              • SHA256 e5ef631c6b49b57af817617c5b9a4197fd12b2b74baea06e52cd2a54eae73fef
              • MD5 SHA1 SHA512 SSDEEP TLSH

              vi.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\vi.mo
              • Size 18KB
              • SHA256 9330d6f539b9d8f504796dc4f5ff79924046fe86cc2862d66eb9db7cbac47f00
              • MD5 SHA1 SHA512 SSDEEP TLSH

              zh-CN.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-CN.mo
              • Size 16KB
              • SHA256 7b20bca865ebdfe12b8f712ff732090f753f1c42becfde41941cc06fde2fedf2
              • MD5 SHA1 SHA512 SSDEEP TLSH

              zh-Hant-HK.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant-HK.mo
              • Size 16KB
              • SHA256 1928e0496087f1fcc31cd27ef6783db3d16c5252852fe56db78476dae4ca87f4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              zh-Hant.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
              • Size 16KB
              • SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
              • MD5 SHA1 SHA512 SSDEEP TLSH

              zu.mo

              • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zu.mo
              • Size 17KB
              • SHA256 8842e30b944b3ce991c4f0c356a28d2783570225ee5fb007d602c4aef54765ea
              • MD5 SHA1 SHA512 SSDEEP TLSH

              prefs

              • Path C:\Users\Admin\AppData\Roaming\Spotify\prefs
              • Size 157B
              • SHA256 a8f436c0e830b20d449eefdbc6f25c74c6bef76f2bd7bdd50ce98e178f094812
              • MD5 SHA1 SHA512 TLSH

              resources.pak

              • Path C:\Users\Admin\AppData\Roaming\Spotify\resources.pak
              • Size 20.3MB
              • SHA256 e2a142e80b54d0d7849c1f10b1fda305d90f19d08be68d44f01868d9b187b897
              • MD5 SHA1 SHA512 SSDEEP TLSH

              save-to-spotify.exe

              • Path C:\Users\Admin\AppData\Roaming\Spotify\save-to-spotify.exe
              • Size 10.4MB
              • SHA256 e0284429837b16f14c11be115d6390a6bc2968856e8444a1334d848bf39d9161
              • MD5 SHA1 SHA512 SSDEEP TLSH

              spotify_cli.exe

              • Path C:\Users\Admin\AppData\Roaming\Spotify\spotify_cli.exe
              • Size 2.4MB
              • SHA256 5f44da38fe6a92d7c9f7cd37d4a3ee99839cb4845b61169261e836b68970b174
              • MD5 SHA1 SHA512 SSDEEP TLSH

              toast_icon.png

              • Path C:\Users\Admin\AppData\Roaming\Spotify\toast_icon.png
              • Size 3KB
              • SHA256 9b6b97d13db27d3ebb90a0544ea5a75cc3109e90e51e61831353539adc43f8f3
              • MD5 SHA1 SHA512 TLSH

              uninstall.exe

              • Path C:\Users\Admin\AppData\Roaming\Spotify\uninstall.exe
              • Size 510KB
              • SHA256 b2e6a7bbc799dc9f909132432495e9bee1e3d288d8f171ca79db9bd7c8e706bd
              • MD5 SHA1 SHA512 SSDEEP TLSH

              v8_context_snapshot.bin

              • Path C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin
              • Size 17.7MB
              • SHA256 82eb4d24900cc74888a5066fc134a5c83a7f73193c791a056fea6abfccc6d24e
              • MD5 SHA1 SHA512 SSDEEP TLSH

              vk_swiftshader.dll

              • Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll
              • Size 5.2MB
              • SHA256 17052c5490ace6b67a83a2e0f9be922fbdcbfddf5a47071f457b56775a1a716d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              vk_swiftshader_icd.json

              • Path C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader_icd.json
              • Size 106B
              • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
              • MD5 SHA1 SHA512 TLSH

              vulkan-1.dll

              • Path C:\Users\Admin\AppData\Roaming\Spotify\vulkan-1.dll
              • Size 954KB
              • SHA256 f04037acb9fe188a6978f0b019a221ff393fa7a1135aad195f3b76b932b95bb4
              • MD5 SHA1 SHA512 SSDEEP TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1117311978\manifest.json
              • Size 82B
              • SHA256 10068caf4ca65248f2479f859c264e77ef420877065374278bea00269f2ab551
              • MD5 SHA1 SHA512 TLSH

              hyph-as.hyb

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1176001843\hyph-as.hyb
              • Size 703B
              • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
              • MD5 SHA1 SHA512 TLSH

              hyph-hi.hyb

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1176001843\hyph-hi.hyb
              • Size 687B
              • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
              • MD5 SHA1 SHA512 TLSH

              hyph-nb.hyb

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1176001843\hyph-nb.hyb
              • Size 141KB
              • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
              • MD5 SHA1 SHA512 SSDEEP TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1176001843\manifest.json
              • Size 82B
              • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1300560815\manifest.json
              • Size 114B
              • SHA256 36018003c264ea6b237ae1f816818bea1ad09e81702d26926c91138527b1bb24
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1307858464\manifest.json
              • Size 202B
              • SHA256 8bd59f33a6e286c7e7352dfaebc9b03cea4e0e959a8ebb2f04b69bd92e107dc1
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1381098363\manifest.json
              • Size 1005B
              • SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1497082210\manifest.json
              • Size 91B
              • SHA256 738bc3a347d6ffbcaad9fc9db10a11059993886d214c56025cc978207e759cde
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1539714981\manifest.json
              • Size 76B
              • SHA256 20b91160e2611d3159ad82857323febc906457756678ab73f305c3a1e399d18d
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1643250605\manifest.json
              • Size 97B
              • SHA256 335b1566f2a398f764be95e60ea16352e087262dfffa2616576bb22947d7e4bc
              • MD5 SHA1 SHA512 TLSH

              LICENSE

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1693255772\LICENSE
              • Size 1KB
              • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1693255772\manifest.json
              • Size 80B
              • SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1743110101\manifest.json
              • Size 108B
              • SHA256 e6d2d25773e4c21f0774d03f7e60d4532b72cbd442cc2b01800d5bae691f4a0b
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1744471867\manifest.json
              • Size 73B
              • SHA256 99d319d6a193c0b9cfad8c285e7c6b8f080404d555bdd370d7330b2317027e96
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_1965331398\manifest.json
              • Size 95B
              • SHA256 9a0ecd86cb68c8a1ea9a2d7c18deb803eddf457ef104a214a076e6804bf195fc
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_209193097\manifest.json
              • Size 108B
              • SHA256 ba6fcb8964f3dd492fec803586a6cf000789745e0f6dee9a89f7eb1ab9d470be
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_2117064097\manifest.json
              • Size 83B
              • SHA256 8d9dc0976c7c3af84bcc5647d6f551c97c79f37901a085c97dca6ed8a9995ff3
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_2140141396\manifest.json
              • Size 94B
              • SHA256 95a2b0748baee70740ff2d5da78f98b5a29950562f989591f0b0b5bf13354b85
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_686087857\manifest.json
              • Size 109B
              • SHA256 cd12b0e4eddb8b1d33524a6a41667df705937a3ace3e2f8d6b8371cc88b3eb70
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_824959181\manifest.json
              • Size 86B
              • SHA256 31a56f514d228a98683b8cbf7e8a3ced78857ef3e745a06fbc2c5b33162d3220
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_944851067\manifest.json
              • Size 72B
              • SHA256 a408d874f731da9fd242aca690324d2fa05a2b80ee0744e49543dd514a1cb07f
              • MD5 SHA1 SHA512 TLSH

              manifest.json

              • Path C:\Windows\SystemTemp\chromium_chrome_Unpacker_BeginUnzipping2296_989914608\manifest.json
              • Size 69B
              • SHA256 aeb364b60303212808fac02eb490ee5b054ae843ce084376e5981ef8767e5198
              • MD5 SHA1 SHA512 TLSH

              memory/2296-819-0x00007FFFEB030000-0x00007FFFEDA7B000-memory.dmp

              memory/2296-752-0x00007FFFEB030000-0x00007FFFEDA7B000-memory.dmp

              memory/2296-450-0x00007FFFEB030000-0x00007FFFEDA7B000-memory.dmp

              memory/2296-447-0x00007FFFEB030000-0x00007FFFEDA7B000-memory.dmp

              memory/2648-517-0x00007FF80E790000-0x00007FF80E791000-memory.dmp

              memory/2648-516-0x00007FF80F030000-0x00007FF80F031000-memory.dmp

              memory/5520-1175-0x000001E5DE1C0000-0x000001E5DE1C1000-memory.dmp

              memory/5520-1167-0x000001E5DE1C0000-0x000001E5DE1C1000-memory.dmp

              memory/5520-1169-0x000001E5DE1C0000-0x000001E5DE1C1000-memory.dmp

              memory/5520-1173-0x000001E5DE1C0000-0x000001E5DE1C1000-memory.dmp

              memory/5520-1178-0x000001E5DE1C0000-0x000001E5DE1C1000-memory.dmp

              memory/5520-1177-0x000001E5DE1C0000-0x000001E5DE1C1000-memory.dmp

              memory/5520-1174-0x000001E5DE1C0000-0x000001E5DE1C1000-memory.dmp

              memory/5520-1176-0x000001E5DE1C0000-0x000001E5DE1C1000-memory.dmp

              memory/5968-1334-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1336-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1327-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1321-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1323-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1338-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1337-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1332-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1335-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1328-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1333-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1331-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1330-0x00000222A0E10000-0x00000222A0E12000-memory.dmp

              memory/5968-1329-0x00000222A0E10000-0x00000222A0E12000-memory.dmp