Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Explorer' = '%WINDIR%\resources\themes\explorer.exe RO'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'Svchost' = '%WINDIR%\resources\svchost.exe RO'
- <SYSTEM32>\tasks\svchost
- [<HKLM>\SYSTEM\CurrentControlSet\Services\Schedule] 'Start' = '00000002'
- hidden files
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
- %WINDIR%\resources\themes\icsys.icn.exe
- %APPDATA%\spotify\~tmp_2524_118_~
- %APPDATA%\spotify\~tmp_2524_116_~
- %APPDATA%\spotify\~tmp_2524_114_~
- %APPDATA%\spotify\~tmp_2524_112_~
- %APPDATA%\spotify\~tmp_2524_110_~
- %APPDATA%\spotify\~tmp_2524_108_~
- %APPDATA%\spotify\~tmp_2524_106_~
- %APPDATA%\spotify\~tmp_2524_104_~
- %APPDATA%\spotify\~tmp_2524_102_~
- %APPDATA%\spotify\~tmp_2524_100_~
- %APPDATA%\spotify\~tmp_2524_98_~
- %APPDATA%\spotify\~tmp_2524_96_~
- %APPDATA%\spotify\~tmp_2524_94_~
- %APPDATA%\spotify\~tmp_2524_92_~
- %APPDATA%\spotify\~tmp_2524_90_~
- %APPDATA%\spotify\~tmp_2524_88_~
- %APPDATA%\spotify\~tmp_2524_86_~
- %APPDATA%\spotify\~tmp_2524_84_~
- %APPDATA%\spotify\~tmp_2524_82_~
- %APPDATA%\spotify\~tmp_2524_120_~
- %APPDATA%\spotify\~tmp_2524_124_~
- %APPDATA%\spotify\~tmp_2524_166_~
- %APPDATA%\spotify\~tmp_2524_126_~
- %APPDATA%\spotify\~tmp_2524_164_~
- %APPDATA%\spotify\~tmp_2524_162_~
- %APPDATA%\spotify\~tmp_2524_160_~
- %APPDATA%\spotify\~tmp_2524_158_~
- %APPDATA%\spotify\~tmp_2524_156_~
- %APPDATA%\spotify\~tmp_2524_154_~
- %APPDATA%\spotify\~tmp_2524_152_~
- %APPDATA%\spotify\~tmp_2524_150_~
- %APPDATA%\spotify\~tmp_2524_148_~
- %APPDATA%\spotify\~tmp_2524_146_~
- %APPDATA%\spotify\~tmp_2524_144_~
- %APPDATA%\spotify\~tmp_2524_142_~
- %APPDATA%\spotify\~tmp_2524_140_~
- %APPDATA%\spotify\~tmp_2524_138_~
- %APPDATA%\spotify\~tmp_2524_136_~
- %APPDATA%\spotify\~tmp_2524_134_~
- %APPDATA%\spotify\~tmp_2524_132_~
- %APPDATA%\spotify\~tmp_2524_130_~
- %APPDATA%\spotify\~tmp_2524_128_~
- %APPDATA%\spotify\~tmp_2524_80_~
- %APPDATA%\spotify\~tmp_2524_122_~
- %APPDATA%\spotify\~tmp_2524_78_~
- %APPDATA%\spotify\~tmp_2524_30_~
- %APPDATA%\spotify\~tmp_2524_26_~
- %APPDATA%\spotify\~tmp_2524_24_~
- %APPDATA%\spotify\~tmp_2524_22_~
- %APPDATA%\spotify\~tmp_2524_20_~
- %APPDATA%\spotify\~tmp_2524_18_~
- %APPDATA%\spotify\~tmp_2524_16_~
- %APPDATA%\spotify\~tmp_2524_14_~
- %APPDATA%\spotify\~tmp_2524_12_~
- %APPDATA%\spotify\~tmp_2524_10_~
- %APPDATA%\spotify\~tmp_2524_8_~
- %APPDATA%\spotify\~tmp_2524_6_~
- %APPDATA%\spotify\~tmp_2524_4_~
- %APPDATA%\spotify\~tmp_2524_2_~
- %APPDATA%\spotify\~tmp_2524_0_~
- %APPDATA%\spotify\spwebinst0.exe
- %WINDIR%\resources\svchost.exe
- %WINDIR%\resources\spoolsv.exe
- %WINDIR%\resources\themes\explorer.exe
- <Full path to file>В
- %APPDATA%\spotify\~tmp_2524_28_~
- %APPDATA%\spotify\~tmp_2524_32_~
- %APPDATA%\spotify\~tmp_2524_74_~
- %APPDATA%\spotify\~tmp_2524_34_~
- %APPDATA%\spotify\~tmp_2524_72_~
- %APPDATA%\spotify\~tmp_2524_70_~
- %APPDATA%\spotify\~tmp_2524_68_~
- %APPDATA%\spotify\~tmp_2524_66_~
- %APPDATA%\spotify\~tmp_2524_64_~
- %APPDATA%\spotify\~tmp_2524_62_~
- %APPDATA%\spotify\~tmp_2524_60_~
- %APPDATA%\spotify\~tmp_2524_58_~
- %APPDATA%\spotify\~tmp_2524_56_~
- %APPDATA%\spotify\~tmp_2524_54_~
- %APPDATA%\spotify\~tmp_2524_52_~
- %APPDATA%\spotify\~tmp_2524_50_~
- %APPDATA%\spotify\~tmp_2524_48_~
- %APPDATA%\spotify\~tmp_2524_46_~
- %APPDATA%\spotify\~tmp_2524_44_~
- %APPDATA%\spotify\~tmp_2524_42_~
- %APPDATA%\spotify\~tmp_2524_40_~
- %APPDATA%\spotify\~tmp_2524_38_~
- %APPDATA%\spotify\~tmp_2524_36_~
- %APPDATA%\spotify\~tmp_2524_76_~
- %LOCALAPPDATA%\spotify\user data\crashpadmetrics-active.pma
- %WINDIR%\resources\themes\explorer.exe
- %WINDIR%\resources\spoolsv.exe
- %WINDIR%\resources\svchost.exe
- %APPDATA%\spotify\spwebinst0.exe
- from %APPDATA%\spotify\~tmp_2524_0_~ to %APPDATA%\spotify\apps\login.spa
- from %APPDATA%\spotify\~tmp_2524_122_~ to %APPDATA%\spotify\locales\vi.mo
- from %APPDATA%\spotify\~tmp_2524_120_~ to %APPDATA%\spotify\locales\ur.mo
- from %APPDATA%\spotify\~tmp_2524_118_~ to %APPDATA%\spotify\locales\uk.mo
- from %APPDATA%\spotify\~tmp_2524_116_~ to %APPDATA%\spotify\locales\tr.mo
- from %APPDATA%\spotify\~tmp_2524_114_~ to %APPDATA%\spotify\locales\th.mo
- from %APPDATA%\spotify\~tmp_2524_112_~ to %APPDATA%\spotify\locales\te.mo
- from %APPDATA%\spotify\~tmp_2524_110_~ to %APPDATA%\spotify\locales\ta.mo
- from %APPDATA%\spotify\~tmp_2524_108_~ to %APPDATA%\spotify\locales\sw.mo
- from %APPDATA%\spotify\~tmp_2524_106_~ to %APPDATA%\spotify\locales\sv.mo
- from %APPDATA%\spotify\~tmp_2524_104_~ to %APPDATA%\spotify\locales\sr.mo
- from %APPDATA%\spotify\~tmp_2524_102_~ to %APPDATA%\spotify\locales\sl.mo
- from %APPDATA%\spotify\~tmp_2524_100_~ to %APPDATA%\spotify\locales\sk.mo
- from %APPDATA%\spotify\~tmp_2524_98_~ to %APPDATA%\spotify\locales\ru.mo
- from %APPDATA%\spotify\~tmp_2524_96_~ to %APPDATA%\spotify\locales\ro.mo
- from %APPDATA%\spotify\~tmp_2524_94_~ to %APPDATA%\spotify\locales\pt-pt.mo
- from %APPDATA%\spotify\~tmp_2524_92_~ to %APPDATA%\spotify\locales\pt-br.mo
- from %APPDATA%\spotify\~tmp_2524_90_~ to %APPDATA%\spotify\locales\pl.mo
- from %APPDATA%\spotify\~tmp_2524_86_~ to %APPDATA%\spotify\locales\pa-in.mo
- from %APPDATA%\spotify\~tmp_2524_88_~ to %APPDATA%\spotify\locales\pa-pk.mo
- from %APPDATA%\spotify\~tmp_2524_124_~ to %APPDATA%\spotify\locales\zh-cn.mo
- from %APPDATA%\spotify\~tmp_2524_126_~ to %APPDATA%\spotify\locales\zh-hant.mo
- from %APPDATA%\spotify\~tmp_2524_162_~ to %APPDATA%\spotify\vk_swiftshader.dll
- from %APPDATA%\spotify\~tmp_2524_160_~ to %APPDATA%\spotify\v8_context_snapshot.bin
- from %APPDATA%\spotify\~tmp_2524_158_~ to %APPDATA%\spotify\snapshot_blob.bin
- from %APPDATA%\spotify\~tmp_2524_156_~ to %APPDATA%\spotify\resources.pak
- from %APPDATA%\spotify\~tmp_2524_154_~ to %APPDATA%\spotify\libcef.dll
- from %APPDATA%\spotify\~tmp_2524_152_~ to %APPDATA%\spotify\libglesv2.dll
- from %APPDATA%\spotify\~tmp_2524_150_~ to %APPDATA%\spotify\libegl.dll
- from %APPDATA%\spotify\~tmp_2524_148_~ to %APPDATA%\spotify\icudtl.dat
- from %APPDATA%\spotify\~tmp_2524_144_~ to %APPDATA%\spotify\crash_reporter.cfg
- from %APPDATA%\spotify\~tmp_2524_60_~ to %APPDATA%\spotify\locales\it.mo
- from %APPDATA%\spotify\~tmp_2524_142_~ to %APPDATA%\spotify\chrome_elf.dll
- from %APPDATA%\spotify\~tmp_2524_140_~ to %APPDATA%\spotify\chrome_200_percent.pak
- from %APPDATA%\spotify\~tmp_2524_138_~ to %APPDATA%\spotify\chrome_100_percent.pak
- from %APPDATA%\spotify\~tmp_2524_136_~ to %APPDATA%\spotify\spotifystartuptask.exe
- from %APPDATA%\spotify\~tmp_2524_134_~ to %APPDATA%\spotify\spotifymigrator.exe
- from %APPDATA%\spotify\~tmp_2524_132_~ to %APPDATA%\spotify\spotify.exe
- from %APPDATA%\spotify\~tmp_2524_130_~ to %APPDATA%\spotify\locales\zu.mo
- from %APPDATA%\spotify\~tmp_2524_128_~ to %APPDATA%\spotify\locales\zh-tw.mo
- from %APPDATA%\spotify\~tmp_2524_84_~ to %APPDATA%\spotify\locales\or.mo
- from %APPDATA%\spotify\~tmp_2524_82_~ to %APPDATA%\spotify\locales\nl.mo
- from %APPDATA%\spotify\~tmp_2524_80_~ to %APPDATA%\spotify\locales\ne.mo
- from %APPDATA%\spotify\~tmp_2524_32_~ to %APPDATA%\spotify\locales\es.mo
- from %APPDATA%\spotify\~tmp_2524_30_~ to %APPDATA%\spotify\locales\es-419.mo
- from %APPDATA%\spotify\~tmp_2524_28_~ to %APPDATA%\spotify\locales\en.mo
- from %APPDATA%\spotify\~tmp_2524_26_~ to %APPDATA%\spotify\locales\en-us.pak
- from %APPDATA%\spotify\~tmp_2524_24_~ to %APPDATA%\spotify\locales\el.mo
- from %APPDATA%\spotify\~tmp_2524_22_~ to %APPDATA%\spotify\locales\de.mo
- from %APPDATA%\spotify\~tmp_2524_20_~ to %APPDATA%\spotify\locales\da.mo
- from %APPDATA%\spotify\~tmp_2524_18_~ to %APPDATA%\spotify\locales\cs.mo
- from %APPDATA%\spotify\~tmp_2524_16_~ to %APPDATA%\spotify\locales\bn.mo
- from %APPDATA%\spotify\~tmp_2524_14_~ to %APPDATA%\spotify\locales\bho.mo
- from %APPDATA%\spotify\~tmp_2524_12_~ to %APPDATA%\spotify\locales\bg.mo
- from %APPDATA%\spotify\~tmp_2524_10_~ to %APPDATA%\spotify\locales\az.mo
- from %APPDATA%\spotify\~tmp_2524_8_~ to %APPDATA%\spotify\locales\ar.mo
- from %APPDATA%\spotify\~tmp_2524_6_~ to %APPDATA%\spotify\locales\am.mo
- from %APPDATA%\spotify\~tmp_2524_4_~ to %APPDATA%\spotify\locales\af.mo
- from %APPDATA%\spotify\~tmp_2524_2_~ to %APPDATA%\spotify\apps\xpui.spa
- from %APPDATA%\spotify\~tmp_2524_36_~ to %APPDATA%\spotify\locales\fa.mo
- from %APPDATA%\spotify\~tmp_2524_38_~ to %APPDATA%\spotify\locales\fi.mo
- from %APPDATA%\spotify\~tmp_2524_34_~ to %APPDATA%\spotify\locales\et.mo
- from %APPDATA%\spotify\~tmp_2524_40_~ to %APPDATA%\spotify\locales\fil.mo
- from %APPDATA%\spotify\~tmp_2524_78_~ to %APPDATA%\spotify\locales\nb.mo
- from %APPDATA%\spotify\~tmp_2524_42_~ to %APPDATA%\spotify\locales\fr-ca.mo
- from %APPDATA%\spotify\~tmp_2524_76_~ to %APPDATA%\spotify\locales\ms.mo
- from %APPDATA%\spotify\~tmp_2524_74_~ to %APPDATA%\spotify\locales\mr.mo
- from %APPDATA%\spotify\~tmp_2524_72_~ to %APPDATA%\spotify\locales\ml.mo
- from %APPDATA%\spotify\~tmp_2524_70_~ to %APPDATA%\spotify\locales\lv.mo
- from %APPDATA%\spotify\~tmp_2524_68_~ to %APPDATA%\spotify\locales\lt.mo
- from %APPDATA%\spotify\~tmp_2524_66_~ to %APPDATA%\spotify\locales\ko.mo
- from %APPDATA%\spotify\~tmp_2524_64_~ to %APPDATA%\spotify\locales\kn.mo
- from %APPDATA%\spotify\~tmp_2524_146_~ to %APPDATA%\spotify\d3dcompiler_47.dll
- from %APPDATA%\spotify\~tmp_2524_164_~ to %APPDATA%\spotify\vk_swiftshader_icd.json
- from %APPDATA%\spotify\~tmp_2524_58_~ to %APPDATA%\spotify\locales\is.mo
- from %APPDATA%\spotify\~tmp_2524_56_~ to %APPDATA%\spotify\locales\id.mo
- from %APPDATA%\spotify\~tmp_2524_54_~ to %APPDATA%\spotify\locales\hu.mo
- from %APPDATA%\spotify\~tmp_2524_52_~ to %APPDATA%\spotify\locales\hr.mo
- from %APPDATA%\spotify\~tmp_2524_50_~ to %APPDATA%\spotify\locales\hi.mo
- from %APPDATA%\spotify\~tmp_2524_48_~ to %APPDATA%\spotify\locales\he.mo
- from %APPDATA%\spotify\~tmp_2524_46_~ to %APPDATA%\spotify\locales\gu.mo
- from %APPDATA%\spotify\~tmp_2524_44_~ to %APPDATA%\spotify\locales\fr.mo
- from %APPDATA%\spotify\~tmp_2524_62_~ to %APPDATA%\spotify\locales\ja.mo
- from %APPDATA%\spotify\~tmp_2524_166_~ to %APPDATA%\spotify\vulkan-1.dll
- 'do####ad.scdn.co':443
- 'microsoft.com':80
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- 'do####ad.scdn.co':443
- DNS ASK do####ad.scdn.co
- DNS ASK microsoft.com
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: 'SpotifyHttpsListener' WindowName: ''
- '<Full path to file>В '
- '%APPDATA%\spotify\spotify.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/104.0.5112.102 Spotify/1.1.94.870" --...
- '%APPDATA%\spotify\spotify.exe' --type=gpu-process --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/104.0.5112.102 Spotify/1.1.94.870" --lang=en --user-data-dir="%LOCALAPPDATA%\Spotify\User Data" --gpu-pref...
- '%APPDATA%\spotify\spotify.exe'
- '%APPDATA%\spotify\spwebinst0.exe' /webinstall
- '%WINDIR%\resources\themes\explorer.exe'
- '%APPDATA%\spotify\spotify.exe' --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=%LOCALAPPDATA%\Spotify\User Data\Crashpad" "--me...
- '%WINDIR%\resources\spoolsv.exe' PR
- '%WINDIR%\resources\spoolsv.exe' SE
- '%WINDIR%\resources\themes\icsys.icn.exe'
- '%APPDATA%\spotify\spotify.exe' --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="Chrome/104.0.5112.102 Spotify/1.1.94.870"...
- '%WINDIR%\resources\svchost.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "svchost" /tr "%WINDIR%\resources\svchost.exe" /sc daily /st 21:27 /f' (with hidden window)
- '%WINDIR%\resources\themes\icsys.icn.exe' ' (with hidden window)
- '%WINDIR%\resources\svchost.exe' ' (with hidden window)
- '%WINDIR%\resources\spoolsv.exe' PR' (with hidden window)
- '%WINDIR%\explorer.exe' ' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "svchost" /tr "%WINDIR%\resources\svchost.exe" /sc daily /st 21:26 /f' (with hidden window)
- '%WINDIR%\resources\themes\explorer.exe' ' (with hidden window)
- '%WINDIR%\resources\spoolsv.exe' SE' (with hidden window)
- '%WINDIR%\explorer.exe'
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "svchost" /tr "%WINDIR%\resources\svchost.exe" /sc daily /st 21:26 /f
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "svchost" /tr "%WINDIR%\resources\svchost.exe" /sc daily /st 21:27 /f
- '<SYSTEM32>\taskeng.exe' {2EED38BB-877D-4425-907D-FB9E9794A6EB} S-1-5-21-1960123792-2022915161-3775307078-1001:wwliheyhopd\user:Interactive:[1]