Analysis

  • max time kernel
    16s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    09-09-2023 15:00

General

  • Target

    discord.exe

  • Size

    108.2MB

  • MD5

    73e882ed6e9604978cbc396bd00a11e5

  • SHA1

    f0524a000c4e1570a3c4fdfd426decb813b28401

  • SHA256

    a785b6bac833f0ebff7132dcd4e93f63db922fdebf6d572205def42925bc56b0

  • SHA512

    7e11cd2bafb4aa1107468162edaf211624852865230dac214a497067b5efea9c783271852afc29bec2a6e62cdda87108fe3676d723d810aee14e38ea946105ee

  • SSDEEP

    3145728:gvHIQcGy6x67p5Q/xXFcHta2A6wFxjp7JD41E:gvpfVs76cNa2A6wXttk1E

Malware Config

Signatures

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry key 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\discord.exe
    "C:\Users\Admin\AppData\Local\Temp\discord.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Windows\SysWOW64\xcopy.exe
      "C:\Windows\System32\xcopy.exe" /Y "C:\Users\Admin\AppData\Local\Temp\DiscordSetup\DiscordSetup.rar"
      2⤵
      • Enumerates system info in registry
      PID:2652
    • C:\Users\Admin\AppData\Local\Temp\DiscordSetup\Discord.exe
      "C:\Users\Admin\AppData\Local\Temp\DiscordSetup\Discord.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:2768
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RMS_{284D6A31-0B8B-48D5-95F7-2614F5A1EFC5}\host.msi" /qn
        3⤵
          PID:1836
      • C:\Users\Admin\AppData\Local\Temp\DiscordSetup\DiscordSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\DiscordSetup\DiscordSetup.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
          "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
          3⤵
          • Executes dropped EXE
          PID:3024
          • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe
            "C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe" --squirrel-install 1.0.9017
            4⤵
              PID:996
              • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe
                C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9017 --annotation=plat=Win32 --annotation=prod=Electron --annotation=ver=22.3.12 --initial-client-data=0x30c,0x310,0x314,0x308,0x318,0x90d4d78,0x90d4d88,0x90d4d94
                5⤵
                  PID:2396
                • C:\Users\Admin\AppData\Local\Discord\Update.exe
                  C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
                  5⤵
                    PID:2408
                  • C:\Windows\SysWOW64\reg.exe
                    C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
                    5⤵
                    • Modifies registry key
                    PID:2352
                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe
                    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1060 --field-trial-handle=1252,i,15020623797234454916,8447072383431385,131072 --disable-features=HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                    5⤵
                      PID:828
                    • C:\Windows\SysWOW64\reg.exe
                      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
                      5⤵
                      • Modifies registry key
                      PID:620
                    • C:\Windows\SysWOW64\reg.exe
                      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
                      5⤵
                      • Modifies registry key
                      PID:1868
                    • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe
                      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1320 --field-trial-handle=1252,i,15020623797234454916,8447072383431385,131072 --disable-features=HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
                      5⤵
                        PID:2604
                      • C:\Windows\SysWOW64\reg.exe
                        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe\",-1" /f
                        5⤵
                        • Modifies registry key
                        PID:2964
                      • C:\Windows\SysWOW64\reg.exe
                        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe\" --url -- \"%1\"" /f
                        5⤵
                        • Modifies registry key
                        PID:1148
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                  PID:3004
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding 71C02EB2A771B789478CB6FC0E91ADDF
                    2⤵
                      PID:2160
                    • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
                      "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" -msi_copy "C:\Users\Admin\AppData\Local\Temp\RMS_{284D6A31-0B8B-48D5-95F7-2614F5A1EFC5}\host.msi"
                      2⤵
                        PID:2724
                      • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                        "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /silentinstall
                        2⤵
                          PID:988
                        • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                          "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /firewall
                          2⤵
                            PID:1092
                          • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                            "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe" /start
                            2⤵
                              PID:948
                          • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
                            "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe"
                            1⤵
                              PID:1780
                              • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
                                "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
                                2⤵
                                  PID:2152
                              • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
                                "C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe" /tray
                                1⤵
                                  PID:1948
                                • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe
                                  "C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe"
                                  1⤵
                                    PID:1672

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Config.Msi\f769f6f.rbs

                                    Filesize

                                    32KB

                                    MD5

                                    d30ed0ad9f8e128f3d3797ae838e564c

                                    SHA1

                                    faa23518e879ad73bde324eb8e3fd770c36269b6

                                    SHA256

                                    135669e670f45c0e48715ce840d23d9a1c82d272ae2067f6023732f5b6b83ff1

                                    SHA512

                                    86460e5ec87502bcbdd06c7baf6c8462fe03d16fd1bb5250bb605610258bbe0965f0e4d802dea4bbc85bb64cfb7f41480a1f80eab5964904d49dba77f7e2b364

                                  • C:\Program Files (x86)\Remote Manipulator System - Host\libeay32.dll

                                    Filesize

                                    1.3MB

                                    MD5

                                    4cb2e1b9294ddae1bf7dcaaf42b365d1

                                    SHA1

                                    a225f53a8403d9b73d77bcbb075194520cce5a14

                                    SHA256

                                    a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

                                    SHA512

                                    46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

                                  • C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe

                                    Filesize

                                    6.3MB

                                    MD5

                                    cd97f125a6462574065fd1e3854f9d7f

                                    SHA1

                                    fee8a2a4b8e7cd15d69915f2f9d84ccf09f9868f

                                    SHA256

                                    b46f3ae494d9effb0b3cfb4ab6d364ecff8d65f94090344f6526094d067b5df2

                                    SHA512

                                    5f56b22b7d73f2037ca192572cb4e8a35399a2dc62bb7aa5613db59992770e7af356daf6fc012b2ed2da9ab5ad4271c227c93229a512d1a20ee492d2b5459b24

                                  • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

                                    Filesize

                                    12.6MB

                                    MD5

                                    55d66bd554511f803bebead2bd1bfde0

                                    SHA1

                                    34d8176565909b7b756d92a32cd8a50185f998f1

                                    SHA256

                                    decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd

                                    SHA512

                                    cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc

                                  • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

                                    Filesize

                                    12.6MB

                                    MD5

                                    55d66bd554511f803bebead2bd1bfde0

                                    SHA1

                                    34d8176565909b7b756d92a32cd8a50185f998f1

                                    SHA256

                                    decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd

                                    SHA512

                                    cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc

                                  • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

                                    Filesize

                                    12.6MB

                                    MD5

                                    55d66bd554511f803bebead2bd1bfde0

                                    SHA1

                                    34d8176565909b7b756d92a32cd8a50185f998f1

                                    SHA256

                                    decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd

                                    SHA512

                                    cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc

                                  • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

                                    Filesize

                                    12.6MB

                                    MD5

                                    55d66bd554511f803bebead2bd1bfde0

                                    SHA1

                                    34d8176565909b7b756d92a32cd8a50185f998f1

                                    SHA256

                                    decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd

                                    SHA512

                                    cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc

                                  • C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe

                                    Filesize

                                    12.6MB

                                    MD5

                                    55d66bd554511f803bebead2bd1bfde0

                                    SHA1

                                    34d8176565909b7b756d92a32cd8a50185f998f1

                                    SHA256

                                    decfe9f582f6eed39ade6c5770e4146d4ba9b488b146753d7f652815d25379bd

                                    SHA512

                                    cb66959389ff701b0e56f2c491ced77030755bccd10349a7fb23dac0079eb980f7cc6f2e7ace1f3b4d7d3fbf41f3b440c99331831a3d339569339c6f26efccdc

                                  • C:\Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll

                                    Filesize

                                    337KB

                                    MD5

                                    5c268ca919854fc22d85f916d102ee7f

                                    SHA1

                                    0957cf86e0334673eb45945985b5c033b412be0e

                                    SHA256

                                    1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

                                    SHA512

                                    76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

                                  • C:\ProgramData\Remote Manipulator System\install.log

                                    Filesize

                                    504B

                                    MD5

                                    86e57d435e115a82cc2885b88b26e065

                                    SHA1

                                    f846190ca1f11fe2103937990ee7a8bfb490ce1d

                                    SHA256

                                    02eb282537e8af80685adf65ce389c2cc8befc66f1556594c23eec655d0dfbe0

                                    SHA512

                                    79344e2fbccfaedea06f827cad98238309665820ecea93f760b14769686212dcc808c4066995570adafb0d90beb4c3519a2b0906fbc1f6e01494c46c14d9f4ac

                                  • C:\ProgramData\Remote Manipulator System\install.log

                                    Filesize

                                    710B

                                    MD5

                                    330bcbc557875dd0e7174906226cea21

                                    SHA1

                                    db0f35d155a5b6bb24e0b0e538d57e5710f3bd78

                                    SHA256

                                    4623fa2edd8281b38917825dc7cadca286b213a276c9ac5ade1c71aadb227a27

                                    SHA512

                                    278e3fca3646c06c32a9566709e84fcf0be2284371b7a241a527a9fc1dbdf75a6b9a25a99004bda30b54326166134ae060485c6af694a1097adc5d1aa1984a4c

                                  • C:\Users\Admin\AppData\Local\Discord\Update.exe

                                    Filesize

                                    1.5MB

                                    MD5

                                    13211a1abcd316d5950863db10883cc7

                                    SHA1

                                    cd2cb79376bab12d1cb6cc944c819e8192c2894e

                                    SHA256

                                    33b3abb5cc896f1803066bd28cbeb86cf42c03d82518b22358f41d637e08979b

                                    SHA512

                                    b022c61111d2dbea609b16c4584c08a0f93bba1fb1de54640652f94c20d87783df280e3a2f15f3fb4bc79bcc530738c8bcc97ac7dad63fd00a47caa992f24021

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe

                                    Filesize

                                    125.2MB

                                    MD5

                                    19cdf7266baaff8697b257044baf906d

                                    SHA1

                                    2d35de8708a78618a7e763716d3e0a5270e38407

                                    SHA256

                                    0cdc66052cab1df460e45be8430cab9fcb338b83a964825b4747f17177985999

                                    SHA512

                                    fcb9adb571fd6b8d73c550273ae97d038f46855e868ea404c3fc16a558861c10c53158ab4cca956d8e0b855061fdf98c3599fcc7fe7ae5fe69404b20ed4ef229

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe

                                    Filesize

                                    78.9MB

                                    MD5

                                    c5c7de6da05d14ceb7969599a560bbf3

                                    SHA1

                                    1cf8bffe27c60fb0eb75d7ee4bba5e2041188233

                                    SHA256

                                    b4de0b4946a93b656e003940c2895bc5ad21271117fb19206088b65a1fd20373

                                    SHA512

                                    27ebe90c851d1c46ee9df106ba6abca5fa0fc8d23eae9c8822efc8ee31557f6857abdb9f11e5f5d7576ea1c37ba932fb98e7a97247dfa2e52edb7a8013cb6acc

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe

                                    Filesize

                                    103.7MB

                                    MD5

                                    f95ab9c975cef319dfb62c196cb4fb55

                                    SHA1

                                    1e89ed80043c5210f8fa0c0743c9e704ee307a76

                                    SHA256

                                    5f07f835397525eaf3b86053f30ea55a56b073e0bc7d549e7c4ce0346e3f2728

                                    SHA512

                                    ed4c3146bb2a86375127ca93c4698dd7e5456493e603f4e58e2ab5a42705dc46da703437552a32c26785dd1ebaa44424d65f17dd8a1777a6fc89ad98005edb26

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe

                                    Filesize

                                    105.8MB

                                    MD5

                                    29d743f5d4cd399b883b4d299fbc5f4b

                                    SHA1

                                    39b132394f549956986304fe5d72bf17e224e16c

                                    SHA256

                                    ab6e8d17f0e83b34ac137163cfc7d93068564c6d62ec5301c7f2241574d2b30a

                                    SHA512

                                    31cceb6a3397e3b468daa370b8f940291afb8cd820f5a44cd5f237572ff104c487211489d7cae247d9bed336f41d28472b2006692fb79ed553858d9b7239f5f4

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\app.ico

                                    Filesize

                                    278KB

                                    MD5

                                    084f9bc0136f779f82bea88b5c38a358

                                    SHA1

                                    64f210b7888e5474c3aabcb602d895d58929b451

                                    SHA256

                                    dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43

                                    SHA512

                                    65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\chrome_100_percent.pak

                                    Filesize

                                    126KB

                                    MD5

                                    d31f3439e2a3f7bee4ddd26f46a2b83f

                                    SHA1

                                    c5a26f86eb119ae364c5bf707bebed7e871fc214

                                    SHA256

                                    9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e

                                    SHA512

                                    aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\chrome_200_percent.pak

                                    Filesize

                                    175KB

                                    MD5

                                    5604b67e3f03ab2741f910a250c91137

                                    SHA1

                                    a4bb15ac7914c22575f1051a29c448f215fe027f

                                    SHA256

                                    1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c

                                    SHA512

                                    5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\ffmpeg.dll

                                    Filesize

                                    3.1MB

                                    MD5

                                    6174aca1d6be7e765364c77d101c3ddf

                                    SHA1

                                    7047cdd9162652c632f959c56dea99368c085e70

                                    SHA256

                                    5428eacc4a5de44b8fca0629587a9260958e475356e028d161b7190f5c6d8e7d

                                    SHA512

                                    29c396c90f2d9b1a69593c64f79fd33ffc504c2a1721f04a5ba9ada6ada1dd04bb07668bb2a1c6349ee3539021e2f1abd52980768f543e76c0d7929034626006

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\icudtl.dat

                                    Filesize

                                    10.0MB

                                    MD5

                                    76bef9b8bb32e1e54fe1054c97b84a10

                                    SHA1

                                    05dfea2a3afeda799ab01bb7fbce628cacd596f4

                                    SHA256

                                    97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3

                                    SHA512

                                    7330df8129e7a0b7b3655498b2593321595ec29445ea193c8f473c593590f5701eb7125ff6e5cde970c54765f9565fa51c2c54af6e2127f582ab45efa7a3a0f6

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\locales\en-US.pak

                                    Filesize

                                    313KB

                                    MD5

                                    3f6f4b2c2f24e3893882cdaa1ccfe1a3

                                    SHA1

                                    b021cca30e774e0b91ee21b5beb030fea646098f

                                    SHA256

                                    bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f

                                    SHA512

                                    bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\resources.pak

                                    Filesize

                                    5.1MB

                                    MD5

                                    7fd8c5f2e763aa919775b9dccac733de

                                    SHA1

                                    0192874c667b10b9da77e97b9897e794121f4e5c

                                    SHA256

                                    5cffe876882d9f5acf5e2dbc5629b0083a2d3c87e7f57c0992ea5a4c720bf38a

                                    SHA512

                                    977881e62fb96130f9a042b015e7e22ad4ae5ec63b6a73946783d63dd983b8edca021cd6d822ce51828451b2a94c4a20584802b495feaa863aaf6b2660643ff5

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\resources\app.asar

                                    Filesize

                                    5.7MB

                                    MD5

                                    1fa10eee922b00718d6d8709cc44da11

                                    SHA1

                                    11f9df3ce4a62e532447d324f4efbc28e254acf4

                                    SHA256

                                    bb3b397f98b2f8265c70e9b59da20917dc97f2955967fc8f76ebba5deee37c66

                                    SHA512

                                    917d9f69a56a563a795f177ac5bea10727cc660689a78d86fa3907cab9a61da75ebbb75df94ceea694c46d743de0c892ba0d220b3bc9ce8326a56ecd08c92f34

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\resources\build_info.json

                                    Filesize

                                    83B

                                    MD5

                                    2f28ddceeb5fa3bab9b66db004e46ee7

                                    SHA1

                                    ba9bc11373d719d34c2cac0e715ae94d9b4c2a4a

                                    SHA256

                                    c2a91bafba16d455e4203ed0a2e0420ac9e5aeae67445fa40bca3a8ec04e2bd9

                                    SHA512

                                    4c510983aec7710f464a9db98b6322b16eb7e403b82c7a09cfcf29133e4af7285a6487a239a0373412fddcf33b28b3d3b7ffd59ad15505744d010bfce2e50cbd

                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9017\v8_context_snapshot.bin

                                    Filesize

                                    585KB

                                    MD5

                                    b59edfc69aba2f4c433d5b0861d9ac31

                                    SHA1

                                    a2adeb4d3b45170351d1c8ba0dafde71fe35b9c7

                                    SHA256

                                    82c3df9c5e8f300b1af7b1d070163b43648a762acff0ce78f801382d9cd58d16

                                    SHA512

                                    b737160e99b6baa6f960316a223b47690335372ee2d9bf0331e331041dd2e8f727805377ee673e3ace494af01914d301b7e27c5fe5f6642ee5d08afa5442f8f9

                                  • C:\Users\Admin\AppData\Local\Discord\packages\Discord-1.0.9017-full.nupkg

                                    Filesize

                                    90.4MB

                                    MD5

                                    a7290757f7a056fb4c2892fa7919d984

                                    SHA1

                                    0396e5c0a2d6c403573599a21adf71753543e525

                                    SHA256

                                    2ea4855318e884ca1c17936143a535549bb84e09272c383722dd93a05a2b012f

                                    SHA512

                                    4a7a842a34a314346f8e257bb4eeee57b6e066fc8088260c7a15bd4284da2976da2d46c13ac0db7d1e29221bb074072d9ef021e7b4e52d532b4cf798d2f2e080

                                  • C:\Users\Admin\AppData\Local\Discord\packages\RELEASES

                                    Filesize

                                    80B

                                    MD5

                                    6ecf7105186a731a7d19d708cde5a9dd

                                    SHA1

                                    67088525f6c653341ed1a57d41a13e526fe61d6f

                                    SHA256

                                    0e23f3ad5a0d4b487a6b1224dfcb869894cc941ff3f4c9d0f2b4dd304bd84109

                                    SHA512

                                    fea1ae5fd846a44351682b8b8976e0f1c97f1f0d767535d61132ffef08ee04668b9b36fd09c76619c5b7f560bafa3bc12dbc952e47c764d9669945bd777e3f14

                                  • C:\Users\Admin\AppData\Local\Discord\update.exe

                                    Filesize

                                    1.5MB

                                    MD5

                                    13211a1abcd316d5950863db10883cc7

                                    SHA1

                                    cd2cb79376bab12d1cb6cc944c819e8192c2894e

                                    SHA256

                                    33b3abb5cc896f1803066bd28cbeb86cf42c03d82518b22358f41d637e08979b

                                    SHA512

                                    b022c61111d2dbea609b16c4584c08a0f93bba1fb1de54640652f94c20d87783df280e3a2f15f3fb4bc79bcc530738c8bcc97ac7dad63fd00a47caa992f24021

                                  • C:\Users\Admin\AppData\Local\SquirrelTemp\Discord-1.0.9017-full.nupkg

                                    Filesize

                                    90.4MB

                                    MD5

                                    a7290757f7a056fb4c2892fa7919d984

                                    SHA1

                                    0396e5c0a2d6c403573599a21adf71753543e525

                                    SHA256

                                    2ea4855318e884ca1c17936143a535549bb84e09272c383722dd93a05a2b012f

                                    SHA512

                                    4a7a842a34a314346f8e257bb4eeee57b6e066fc8088260c7a15bd4284da2976da2d46c13ac0db7d1e29221bb074072d9ef021e7b4e52d532b4cf798d2f2e080

                                  • C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

                                    Filesize

                                    80B

                                    MD5

                                    6ecf7105186a731a7d19d708cde5a9dd

                                    SHA1

                                    67088525f6c653341ed1a57d41a13e526fe61d6f

                                    SHA256

                                    0e23f3ad5a0d4b487a6b1224dfcb869894cc941ff3f4c9d0f2b4dd304bd84109

                                    SHA512

                                    fea1ae5fd846a44351682b8b8976e0f1c97f1f0d767535d61132ffef08ee04668b9b36fd09c76619c5b7f560bafa3bc12dbc952e47c764d9669945bd777e3f14

                                  • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

                                    Filesize

                                    1.5MB

                                    MD5

                                    13211a1abcd316d5950863db10883cc7

                                    SHA1

                                    cd2cb79376bab12d1cb6cc944c819e8192c2894e

                                    SHA256

                                    33b3abb5cc896f1803066bd28cbeb86cf42c03d82518b22358f41d637e08979b

                                    SHA512

                                    b022c61111d2dbea609b16c4584c08a0f93bba1fb1de54640652f94c20d87783df280e3a2f15f3fb4bc79bcc530738c8bcc97ac7dad63fd00a47caa992f24021

                                  • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

                                    Filesize

                                    1.5MB

                                    MD5

                                    13211a1abcd316d5950863db10883cc7

                                    SHA1

                                    cd2cb79376bab12d1cb6cc944c819e8192c2894e

                                    SHA256

                                    33b3abb5cc896f1803066bd28cbeb86cf42c03d82518b22358f41d637e08979b

                                    SHA512

                                    b022c61111d2dbea609b16c4584c08a0f93bba1fb1de54640652f94c20d87783df280e3a2f15f3fb4bc79bcc530738c8bcc97ac7dad63fd00a47caa992f24021

                                  • C:\Users\Admin\AppData\Local\Temp\CabA17F.tmp

                                    Filesize

                                    61KB

                                    MD5

                                    f3441b8572aae8801c04f3060b550443

                                    SHA1

                                    4ef0a35436125d6821831ef36c28ffaf196cda15

                                    SHA256

                                    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

                                    SHA512

                                    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

                                  • C:\Users\Admin\AppData\Local\Temp\DiscordSetup\Discord.exe

                                    Filesize

                                    17.2MB

                                    MD5

                                    54373b0f78368991613b2de88c88e031

                                    SHA1

                                    101a9b7c1d718b4736022a1512339b19595a1249

                                    SHA256

                                    3c77c16ee21ff2f584b1eb5df4882976a934d50d1d4e0886b98bf4d33fe1dccc

                                    SHA512

                                    7f35b5aa86a86a986888134230f1e2ce3d77fde1123c714b3f72bcde1272d3fa1dcc05406dca9c5cd25f807f92976d0d77016f9fbdca7017412b4f09ecde0f5d

                                  • C:\Users\Admin\AppData\Local\Temp\DiscordSetup\Discord.exe

                                    Filesize

                                    17.2MB

                                    MD5

                                    54373b0f78368991613b2de88c88e031

                                    SHA1

                                    101a9b7c1d718b4736022a1512339b19595a1249

                                    SHA256

                                    3c77c16ee21ff2f584b1eb5df4882976a934d50d1d4e0886b98bf4d33fe1dccc

                                    SHA512

                                    7f35b5aa86a86a986888134230f1e2ce3d77fde1123c714b3f72bcde1272d3fa1dcc05406dca9c5cd25f807f92976d0d77016f9fbdca7017412b4f09ecde0f5d

                                  • C:\Users\Admin\AppData\Local\Temp\DiscordSetup\DiscordSetup.exe

                                    Filesize

                                    91.3MB

                                    MD5

                                    8b004a14720766c0a8d72b32120e8659

                                    SHA1

                                    928ed1f321dc7e092fc8c3a097b812028c3cbd52

                                    SHA256

                                    a774a6d44916e60cb7a8f5c4dc8ae9dbb27162847a54b608149844419a58b331

                                    SHA512

                                    cb257eb2a1cf690d1600f5b7d5502fda5d72da586f1e5b2618969a14167fcca130c4212330d0061b8c97e6336725864ff316a1dfccc20bb59ca89cadb44e6d4a

                                  • C:\Users\Admin\AppData\Local\Temp\DiscordSetup\DiscordSetup.exe

                                    Filesize

                                    91.3MB

                                    MD5

                                    8b004a14720766c0a8d72b32120e8659

                                    SHA1

                                    928ed1f321dc7e092fc8c3a097b812028c3cbd52

                                    SHA256

                                    a774a6d44916e60cb7a8f5c4dc8ae9dbb27162847a54b608149844419a58b331

                                    SHA512

                                    cb257eb2a1cf690d1600f5b7d5502fda5d72da586f1e5b2618969a14167fcca130c4212330d0061b8c97e6336725864ff316a1dfccc20bb59ca89cadb44e6d4a

                                  • C:\Users\Admin\AppData\Local\Temp\RMS_{284D6A31-0B8B-48D5-95F7-2614F5A1EFC5}\host.msi

                                    Filesize

                                    17.4MB

                                    MD5

                                    bac7724f2bb43c352494c77bc99d3e5c

                                    SHA1

                                    f440a950e53adad76238db2e084374fc74a5711b

                                    SHA256

                                    a5a34195a4db94f212535d5182a044d74fe67b31a3e50d7d26148e6d1a103793

                                    SHA512

                                    1e7e85915293db5c9ee9dc27604d1f9c83ad66aec28aa82544d29f2ee4ffca72349c0b828a17fe1b08fab206b3695ce7072227ded23bb315db6f663e93427b1d

                                  • C:\Users\Admin\AppData\Local\Temp\RMS_{284D6A31-0B8B-48D5-95F7-2614F5A1EFC5}\host.msi

                                    Filesize

                                    17.4MB

                                    MD5

                                    bac7724f2bb43c352494c77bc99d3e5c

                                    SHA1

                                    f440a950e53adad76238db2e084374fc74a5711b

                                    SHA256

                                    a5a34195a4db94f212535d5182a044d74fe67b31a3e50d7d26148e6d1a103793

                                    SHA512

                                    1e7e85915293db5c9ee9dc27604d1f9c83ad66aec28aa82544d29f2ee4ffca72349c0b828a17fe1b08fab206b3695ce7072227ded23bb315db6f663e93427b1d

                                  • C:\Users\Admin\AppData\Local\Temp\TarA21E.tmp

                                    Filesize

                                    163KB

                                    MD5

                                    9441737383d21192400eca82fda910ec

                                    SHA1

                                    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

                                    SHA256

                                    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

                                    SHA512

                                    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

                                  • C:\Users\Admin\AppData\Roaming\discord\Local Storage\leveldb\CURRENT~RFf775541.TMP

                                    Filesize

                                    16B

                                    MD5

                                    46295cac801e5d4857d09837238a6394

                                    SHA1

                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                    SHA256

                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                    SHA512

                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                  • C:\Windows\Installer\MSIAE91.tmp

                                    Filesize

                                    153KB

                                    MD5

                                    52185b209cfdb02d88b4a40a4bdf0911

                                    SHA1

                                    aa35fedfeefbee93bcca5a30feed8d240e2d1c95

                                    SHA256

                                    756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492

                                    SHA512

                                    8493e1996b6038bcb49fbce539c8ec8d6b8f86cf5aff4dc9870f66d77f179ae06e0539e06046a03a64a3e29c6b3693b83bf4c5a3d7dae2f989d1e8320d963cb3

                                  • \??\PIPE\srvsvc

                                    MD5

                                    d41d8cd98f00b204e9800998ecf8427e

                                    SHA1

                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                    SHA256

                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                    SHA512

                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                  • \??\PIPE\wkssvc

                                    MD5

                                    d41d8cd98f00b204e9800998ecf8427e

                                    SHA1

                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                    SHA256

                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                    SHA512

                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                  • \??\PIPE\wkssvc

                                    MD5

                                    d41d8cd98f00b204e9800998ecf8427e

                                    SHA1

                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                    SHA256

                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                    SHA512

                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                  • \Program Files (x86)\Remote Manipulator System - Host\libeay32.dll

                                    Filesize

                                    1.3MB

                                    MD5

                                    4cb2e1b9294ddae1bf7dcaaf42b365d1

                                    SHA1

                                    a225f53a8403d9b73d77bcbb075194520cce5a14

                                    SHA256

                                    a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

                                    SHA512

                                    46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

                                  • \Program Files (x86)\Remote Manipulator System - Host\libeay32.dll

                                    Filesize

                                    1.3MB

                                    MD5

                                    4cb2e1b9294ddae1bf7dcaaf42b365d1

                                    SHA1

                                    a225f53a8403d9b73d77bcbb075194520cce5a14

                                    SHA256

                                    a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

                                    SHA512

                                    46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

                                  • \Program Files (x86)\Remote Manipulator System - Host\libeay32.dll

                                    Filesize

                                    1.3MB

                                    MD5

                                    4cb2e1b9294ddae1bf7dcaaf42b365d1

                                    SHA1

                                    a225f53a8403d9b73d77bcbb075194520cce5a14

                                    SHA256

                                    a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

                                    SHA512

                                    46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

                                  • \Program Files (x86)\Remote Manipulator System - Host\libeay32.dll

                                    Filesize

                                    1.3MB

                                    MD5

                                    4cb2e1b9294ddae1bf7dcaaf42b365d1

                                    SHA1

                                    a225f53a8403d9b73d77bcbb075194520cce5a14

                                    SHA256

                                    a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884

                                    SHA512

                                    46cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb

                                  • \Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll

                                    Filesize

                                    337KB

                                    MD5

                                    5c268ca919854fc22d85f916d102ee7f

                                    SHA1

                                    0957cf86e0334673eb45945985b5c033b412be0e

                                    SHA256

                                    1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

                                    SHA512

                                    76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

                                  • \Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll

                                    Filesize

                                    337KB

                                    MD5

                                    5c268ca919854fc22d85f916d102ee7f

                                    SHA1

                                    0957cf86e0334673eb45945985b5c033b412be0e

                                    SHA256

                                    1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

                                    SHA512

                                    76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

                                  • \Program Files (x86)\Remote Manipulator System - Host\ssleay32.dll

                                    Filesize

                                    337KB

                                    MD5

                                    5c268ca919854fc22d85f916d102ee7f

                                    SHA1

                                    0957cf86e0334673eb45945985b5c033b412be0e

                                    SHA256

                                    1f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56

                                    SHA512

                                    76d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310

                                  • \Users\Admin\AppData\Local\Discord\Update.exe

                                    Filesize

                                    1.5MB

                                    MD5

                                    13211a1abcd316d5950863db10883cc7

                                    SHA1

                                    cd2cb79376bab12d1cb6cc944c819e8192c2894e

                                    SHA256

                                    33b3abb5cc896f1803066bd28cbeb86cf42c03d82518b22358f41d637e08979b

                                    SHA512

                                    b022c61111d2dbea609b16c4584c08a0f93bba1fb1de54640652f94c20d87783df280e3a2f15f3fb4bc79bcc530738c8bcc97ac7dad63fd00a47caa992f24021

                                  • \Users\Admin\AppData\Local\Discord\Update.exe

                                    Filesize

                                    1.5MB

                                    MD5

                                    13211a1abcd316d5950863db10883cc7

                                    SHA1

                                    cd2cb79376bab12d1cb6cc944c819e8192c2894e

                                    SHA256

                                    33b3abb5cc896f1803066bd28cbeb86cf42c03d82518b22358f41d637e08979b

                                    SHA512

                                    b022c61111d2dbea609b16c4584c08a0f93bba1fb1de54640652f94c20d87783df280e3a2f15f3fb4bc79bcc530738c8bcc97ac7dad63fd00a47caa992f24021

                                  • \Users\Admin\AppData\Local\Discord\Update.exe

                                    Filesize

                                    1.5MB

                                    MD5

                                    13211a1abcd316d5950863db10883cc7

                                    SHA1

                                    cd2cb79376bab12d1cb6cc944c819e8192c2894e

                                    SHA256

                                    33b3abb5cc896f1803066bd28cbeb86cf42c03d82518b22358f41d637e08979b

                                    SHA512

                                    b022c61111d2dbea609b16c4584c08a0f93bba1fb1de54640652f94c20d87783df280e3a2f15f3fb4bc79bcc530738c8bcc97ac7dad63fd00a47caa992f24021

                                  • \Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe

                                    Filesize

                                    124.7MB

                                    MD5

                                    8c96569b36c50a666869cf72c5fe2bde

                                    SHA1

                                    8a06097bbcf4b2ed58b1e2416702bb3ec3608e1f

                                    SHA256

                                    706403e8028bf338e21e44b0b92c8277d3c0052303f34024edbd3bbd3c191748

                                    SHA512

                                    d1e610619aba9a5b5cb2a6d97dd8d23d6087ae153c120e067c3021e9603f0fe39e911784889a57fbe69cd9b6e3cc0d5cd0078c827cf3feb7b064ae1e773e6503

                                  • \Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe

                                    Filesize

                                    124.9MB

                                    MD5

                                    5ec6ce8ff5951ecd84ce3231461b9ff5

                                    SHA1

                                    52539e4c922b2a021bdd2930983890c03ec41bc1

                                    SHA256

                                    94068ee325f2d6103b7c8a88290362fbe8490685090be4c8c81809c29131e3ce

                                    SHA512

                                    f2594f03cda6bdc81a7a036ad44ad1c554bc4ba048c2022b1bebb0a81ab26610b7a4b3d1590f3450609203afd4163d72574604a8b7e359d4c93a773c9f1a59c8

                                  • \Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe

                                    Filesize

                                    85.3MB

                                    MD5

                                    d3756d2bd88033afd9a5c4057562713a

                                    SHA1

                                    332388bc3f588f64f052bf1fe99db350ea321a0a

                                    SHA256

                                    44be241cdb4d4732b3f37629f3bba2f2389eafc7fc63cdaf2e76f7b4f5990771

                                    SHA512

                                    6928e630065292454704f51eb7ed5aaaebb7b063a6d0743c5f687039a8cad934684a06d0410c63f6b4feaea5563f576223f9b6ac5e7c363c9c924371c37a526d

                                  • \Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe

                                    Filesize

                                    105.7MB

                                    MD5

                                    51f7f79be96cd0a9597617c5c8923ed0

                                    SHA1

                                    e3bb4e5f022888a7e93c072ce16f747a9666b34d

                                    SHA256

                                    06042d9e253739b502f97ded77055a051307e388f681e166e9dba9f5e5ec25b5

                                    SHA512

                                    07d8fdfc10826e10fd41a9be1c47ab9d1291b172eaf139f40b5c0723381b7a6d85ddf51da47cf2052632611bd11f615dc9ba97d888dc1610e0858e8af30737bf

                                  • \Users\Admin\AppData\Local\Discord\app-1.0.9017\Discord.exe

                                    Filesize

                                    105.6MB

                                    MD5

                                    49ac61ced3a7db37fad5afa21db34430

                                    SHA1

                                    e02be16fe9b31a99b0dda5afae3dff343458a3f4

                                    SHA256

                                    8e8f6d7923152f87f4bff1c4583a36091c007da6ad26ee6e4113af6f5f370d0d

                                    SHA512

                                    a95c437d026af702b45c797064d082849519f874efcd32d0a6667701a6bc4d5922296b426ae2f91a62a4cbb8a0e9fc1589a5dfa4ceb9540dbd1b96a58a6b44c0

                                  • \Users\Admin\AppData\Local\Discord\app-1.0.9017\ffmpeg.dll

                                    Filesize

                                    3.1MB

                                    MD5

                                    6174aca1d6be7e765364c77d101c3ddf

                                    SHA1

                                    7047cdd9162652c632f959c56dea99368c085e70

                                    SHA256

                                    5428eacc4a5de44b8fca0629587a9260958e475356e028d161b7190f5c6d8e7d

                                    SHA512

                                    29c396c90f2d9b1a69593c64f79fd33ffc504c2a1721f04a5ba9ada6ada1dd04bb07668bb2a1c6349ee3539021e2f1abd52980768f543e76c0d7929034626006

                                  • \Users\Admin\AppData\Local\Discord\app-1.0.9017\ffmpeg.dll

                                    Filesize

                                    3.1MB

                                    MD5

                                    6174aca1d6be7e765364c77d101c3ddf

                                    SHA1

                                    7047cdd9162652c632f959c56dea99368c085e70

                                    SHA256

                                    5428eacc4a5de44b8fca0629587a9260958e475356e028d161b7190f5c6d8e7d

                                    SHA512

                                    29c396c90f2d9b1a69593c64f79fd33ffc504c2a1721f04a5ba9ada6ada1dd04bb07668bb2a1c6349ee3539021e2f1abd52980768f543e76c0d7929034626006

                                  • \Users\Admin\AppData\Local\SquirrelTemp\Update.exe

                                    Filesize

                                    1.5MB

                                    MD5

                                    13211a1abcd316d5950863db10883cc7

                                    SHA1

                                    cd2cb79376bab12d1cb6cc944c819e8192c2894e

                                    SHA256

                                    33b3abb5cc896f1803066bd28cbeb86cf42c03d82518b22358f41d637e08979b

                                    SHA512

                                    b022c61111d2dbea609b16c4584c08a0f93bba1fb1de54640652f94c20d87783df280e3a2f15f3fb4bc79bcc530738c8bcc97ac7dad63fd00a47caa992f24021

                                  • \Users\Admin\AppData\Local\Temp\DiscordSetup\Discord.exe

                                    Filesize

                                    17.2MB

                                    MD5

                                    54373b0f78368991613b2de88c88e031

                                    SHA1

                                    101a9b7c1d718b4736022a1512339b19595a1249

                                    SHA256

                                    3c77c16ee21ff2f584b1eb5df4882976a934d50d1d4e0886b98bf4d33fe1dccc

                                    SHA512

                                    7f35b5aa86a86a986888134230f1e2ce3d77fde1123c714b3f72bcde1272d3fa1dcc05406dca9c5cd25f807f92976d0d77016f9fbdca7017412b4f09ecde0f5d

                                  • \Users\Admin\AppData\Local\Temp\DiscordSetup\Discord.exe

                                    Filesize

                                    17.2MB

                                    MD5

                                    54373b0f78368991613b2de88c88e031

                                    SHA1

                                    101a9b7c1d718b4736022a1512339b19595a1249

                                    SHA256

                                    3c77c16ee21ff2f584b1eb5df4882976a934d50d1d4e0886b98bf4d33fe1dccc

                                    SHA512

                                    7f35b5aa86a86a986888134230f1e2ce3d77fde1123c714b3f72bcde1272d3fa1dcc05406dca9c5cd25f807f92976d0d77016f9fbdca7017412b4f09ecde0f5d

                                  • \Users\Admin\AppData\Local\Temp\DiscordSetup\Discord.exe

                                    Filesize

                                    17.2MB

                                    MD5

                                    54373b0f78368991613b2de88c88e031

                                    SHA1

                                    101a9b7c1d718b4736022a1512339b19595a1249

                                    SHA256

                                    3c77c16ee21ff2f584b1eb5df4882976a934d50d1d4e0886b98bf4d33fe1dccc

                                    SHA512

                                    7f35b5aa86a86a986888134230f1e2ce3d77fde1123c714b3f72bcde1272d3fa1dcc05406dca9c5cd25f807f92976d0d77016f9fbdca7017412b4f09ecde0f5d

                                  • \Users\Admin\AppData\Local\Temp\DiscordSetup\Discord.exe

                                    Filesize

                                    17.2MB

                                    MD5

                                    54373b0f78368991613b2de88c88e031

                                    SHA1

                                    101a9b7c1d718b4736022a1512339b19595a1249

                                    SHA256

                                    3c77c16ee21ff2f584b1eb5df4882976a934d50d1d4e0886b98bf4d33fe1dccc

                                    SHA512

                                    7f35b5aa86a86a986888134230f1e2ce3d77fde1123c714b3f72bcde1272d3fa1dcc05406dca9c5cd25f807f92976d0d77016f9fbdca7017412b4f09ecde0f5d

                                  • \Users\Admin\AppData\Local\Temp\DiscordSetup\DiscordSetup.exe

                                    Filesize

                                    91.3MB

                                    MD5

                                    8b004a14720766c0a8d72b32120e8659

                                    SHA1

                                    928ed1f321dc7e092fc8c3a097b812028c3cbd52

                                    SHA256

                                    a774a6d44916e60cb7a8f5c4dc8ae9dbb27162847a54b608149844419a58b331

                                    SHA512

                                    cb257eb2a1cf690d1600f5b7d5502fda5d72da586f1e5b2618969a14167fcca130c4212330d0061b8c97e6336725864ff316a1dfccc20bb59ca89cadb44e6d4a

                                  • \Users\Admin\AppData\Local\Temp\DiscordSetup\DiscordSetup.exe

                                    Filesize

                                    91.3MB

                                    MD5

                                    8b004a14720766c0a8d72b32120e8659

                                    SHA1

                                    928ed1f321dc7e092fc8c3a097b812028c3cbd52

                                    SHA256

                                    a774a6d44916e60cb7a8f5c4dc8ae9dbb27162847a54b608149844419a58b331

                                    SHA512

                                    cb257eb2a1cf690d1600f5b7d5502fda5d72da586f1e5b2618969a14167fcca130c4212330d0061b8c97e6336725864ff316a1dfccc20bb59ca89cadb44e6d4a

                                  • \Users\Admin\AppData\Local\Temp\DiscordSetup\DiscordSetup.exe

                                    Filesize

                                    91.3MB

                                    MD5

                                    8b004a14720766c0a8d72b32120e8659

                                    SHA1

                                    928ed1f321dc7e092fc8c3a097b812028c3cbd52

                                    SHA256

                                    a774a6d44916e60cb7a8f5c4dc8ae9dbb27162847a54b608149844419a58b331

                                    SHA512

                                    cb257eb2a1cf690d1600f5b7d5502fda5d72da586f1e5b2618969a14167fcca130c4212330d0061b8c97e6336725864ff316a1dfccc20bb59ca89cadb44e6d4a

                                  • \Users\Admin\AppData\Local\Temp\DiscordSetup\DiscordSetup.exe

                                    Filesize

                                    91.3MB

                                    MD5

                                    8b004a14720766c0a8d72b32120e8659

                                    SHA1

                                    928ed1f321dc7e092fc8c3a097b812028c3cbd52

                                    SHA256

                                    a774a6d44916e60cb7a8f5c4dc8ae9dbb27162847a54b608149844419a58b331

                                    SHA512

                                    cb257eb2a1cf690d1600f5b7d5502fda5d72da586f1e5b2618969a14167fcca130c4212330d0061b8c97e6336725864ff316a1dfccc20bb59ca89cadb44e6d4a

                                  • \Windows\Installer\MSIAE91.tmp

                                    Filesize

                                    153KB

                                    MD5

                                    52185b209cfdb02d88b4a40a4bdf0911

                                    SHA1

                                    aa35fedfeefbee93bcca5a30feed8d240e2d1c95

                                    SHA256

                                    756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492

                                    SHA512

                                    8493e1996b6038bcb49fbce539c8ec8d6b8f86cf5aff4dc9870f66d77f179ae06e0539e06046a03a64a3e29c6b3693b83bf4c5a3d7dae2f989d1e8320d963cb3

                                  • memory/828-478-0x0000000000940000-0x0000000000941000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/948-510-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/948-467-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/988-397-0x0000000000230000-0x0000000000231000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/988-408-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/1092-433-0x0000000000230000-0x0000000000231000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1092-434-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/1516-17-0x0000000005610000-0x0000000007A4E000-memory.dmp

                                    Filesize

                                    36.2MB

                                  • memory/1516-20-0x0000000005610000-0x0000000007A4E000-memory.dmp

                                    Filesize

                                    36.2MB

                                  • memory/1516-21-0x0000000005610000-0x0000000007A4E000-memory.dmp

                                    Filesize

                                    36.2MB

                                  • memory/1516-16-0x0000000005610000-0x0000000007A4E000-memory.dmp

                                    Filesize

                                    36.2MB

                                  • memory/1672-619-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/1672-635-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/1672-631-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/1672-626-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/1672-622-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/1672-500-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1672-615-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/1672-608-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1672-606-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/1672-638-0x0000000000400000-0x0000000001140000-memory.dmp

                                    Filesize

                                    13.2MB

                                  • memory/1780-513-0x0000000000230000-0x0000000000231000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1780-609-0x0000000000400000-0x0000000000AE5000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/1948-610-0x0000000000400000-0x0000000000AE5000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/1948-514-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1948-641-0x0000000000400000-0x0000000000AE5000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/1948-611-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1948-617-0x0000000000400000-0x0000000000AE5000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/1948-634-0x0000000000400000-0x0000000000AE5000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/1948-628-0x0000000000400000-0x0000000000AE5000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/1948-621-0x0000000000400000-0x0000000000AE5000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/2152-603-0x0000000000230000-0x0000000000231000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/2152-604-0x0000000000400000-0x0000000000AE5000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/2408-449-0x0000000001230000-0x00000000013A6000-memory.dmp

                                    Filesize

                                    1.5MB

                                  • memory/2408-451-0x0000000004EA0000-0x0000000004EE0000-memory.dmp

                                    Filesize

                                    256KB

                                  • memory/2408-450-0x0000000074630000-0x0000000074D1E000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/2408-509-0x0000000074630000-0x0000000074D1E000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/2724-391-0x0000000000400000-0x0000000000AE5000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/2724-386-0x0000000000230000-0x0000000000231000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/2768-53-0x0000000000400000-0x000000000283E000-memory.dmp

                                    Filesize

                                    36.2MB

                                  • memory/2768-487-0x0000000000400000-0x000000000283E000-memory.dmp

                                    Filesize

                                    36.2MB

                                  • memory/2768-22-0x0000000000400000-0x000000000283E000-memory.dmp

                                    Filesize

                                    36.2MB

                                  • memory/2768-23-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/3024-392-0x00000000005A0000-0x00000000005AA000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/3024-442-0x00000000005A0000-0x00000000005AA000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/3024-136-0x0000000074630000-0x0000000074D1E000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/3024-385-0x0000000004C10000-0x0000000004C50000-memory.dmp

                                    Filesize

                                    256KB

                                  • memory/3024-512-0x0000000004C10000-0x0000000004C50000-memory.dmp

                                    Filesize

                                    256KB

                                  • memory/3024-409-0x0000000004C10000-0x0000000004C50000-memory.dmp

                                    Filesize

                                    256KB

                                  • memory/3024-120-0x0000000004C10000-0x0000000004C50000-memory.dmp

                                    Filesize

                                    256KB

                                  • memory/3024-501-0x0000000004C10000-0x0000000004C50000-memory.dmp

                                    Filesize

                                    256KB

                                  • memory/3024-72-0x0000000074630000-0x0000000074D1E000-memory.dmp

                                    Filesize

                                    6.9MB

                                  • memory/3024-393-0x00000000005A0000-0x00000000005AA000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/3024-90-0x0000000000B20000-0x0000000000C96000-memory.dmp

                                    Filesize

                                    1.5MB

                                  • memory/3024-410-0x0000000004C10000-0x0000000004C50000-memory.dmp

                                    Filesize

                                    256KB