249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697

Analysis

max time kernel
114s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BetterDiscord-Windows.exe
Size

75.1MB
MD5

43327119366e52928b9aed0c1e734389
SHA1

3777d8387fba8528b6e433a8e763df5dcd542a48
SHA256

249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697
SHA512

bda75994e6dcf5bc9e5b45d025894d62d0138a9d39c47255cd3b6b6e32f60de973da54bf85de57e8f0ca8a253bf414697c4b06e887d45dded90485ce6832e7f4
SSDEEP

1572864:DMKQ/QO4cQ0dPUnqZUPsziv5IANK+4ZYPDHdH/I1z/dHazC:DzXr50lUnqEneWlWYj21zaC

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BetterDiscord.exeBetterDiscord.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	BetterDiscord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	BetterDiscord.exe

Executes dropped EXE 4 IoCs

Processes:

BetterDiscord.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exe

pid process

2280 BetterDiscord.exe
1712 BetterDiscord.exe
756 BetterDiscord.exe
4076 BetterDiscord.exe

pid	process
2280	BetterDiscord.exe
1712	BetterDiscord.exe
756	BetterDiscord.exe
4076	BetterDiscord.exe

Loads dropped DLL 10 IoCs

Processes:

BetterDiscord-Windows.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exe

pid	process
1916	BetterDiscord-Windows.exe
1916	BetterDiscord-Windows.exe
1916	BetterDiscord-Windows.exe
2280	BetterDiscord.exe
1712	BetterDiscord.exe
756	BetterDiscord.exe
1712	BetterDiscord.exe
1712	BetterDiscord.exe
4076	BetterDiscord.exe
1712	BetterDiscord.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133513947590673386"	chrome.exe

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

BetterDiscord.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	BetterDiscord.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	BetterDiscord.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	BetterDiscord.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

BetterDiscord.exeBetterDiscord.exechrome.exe

pid process

756 BetterDiscord.exe
756 BetterDiscord.exe
4076 BetterDiscord.exe
4076 BetterDiscord.exe
3612 chrome.exe
3612 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

3612 chrome.exe
3612 chrome.exe
3612 chrome.exe

pid	process
756	BetterDiscord.exe
756	BetterDiscord.exe
4076	BetterDiscord.exe
4076	BetterDiscord.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

BetterDiscord-Windows.exeBetterDiscord.exechrome.exe

description	pid	process	target process
PID 1916 wrote to memory of 2280	1916	BetterDiscord-Windows.exe	BetterDiscord.exe
PID 1916 wrote to memory of 2280	1916	BetterDiscord-Windows.exe	BetterDiscord.exe
PID 1916 wrote to memory of 2280	1916	BetterDiscord-Windows.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 1712	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 756	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 756	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 756	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 4076	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 4076	2280	BetterDiscord.exe	BetterDiscord.exe
PID 2280 wrote to memory of 4076	2280	BetterDiscord.exe	BetterDiscord.exe
PID 3612 wrote to memory of 4224	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4224	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe
PID 3612 wrote to memory of 4080	3612	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\BetterDiscord-Windows.exe
"C:\Users\Admin\AppData\Local\Temp\BetterDiscord-Windows.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916

C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2280

C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe
"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=gpu-process --field-trial-handle=1612,12293035539587022614,18180118014795951766,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1620 /prefetch:2
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712

C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe
"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1612,12293035539587022614,18180118014795951766,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 /prefetch:8
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:756

C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe
"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=renderer --field-trial-handle=1612,12293035539587022614,18180118014795951766,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2400 /prefetch:1
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4076

C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe
"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=gpu-process --field-trial-handle=1612,12293035539587022614,18180118014795951766,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3552 /prefetch:2
3⤵
PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8fd119758,0x7ff8fd119768,0x7ff8fd119778
2⤵
PID:4224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:8
2⤵
PID:1148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:8
2⤵
PID:4132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:2
2⤵
PID:4080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:1
2⤵
PID:2316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3148 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:1
2⤵
PID:1412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4640 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:1
2⤵
PID:4972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4716 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:8
2⤵
PID:4368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4864 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:8
2⤵
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:8
2⤵
PID:2100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5212 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:8
2⤵
PID:3432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:8
2⤵
PID:4936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5416 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:1
2⤵
PID:4160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3316 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:1
2⤵
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:8
2⤵
PID:2592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4844 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:1
2⤵
PID:2036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3272 --field-trial-handle=1844,i,2612247078709527260,15549968825080817095,131072 /prefetch:1
2⤵
PID:2068

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
193KB

MD5
7fe2c36271aa8065b034ce9efdbd2a07

SHA1
e22ee654cb122d0d62393dd8d6753d2bcad148a3

SHA256
02cf672988303d8fbdbc7625f54596ece6d83c78152ca6e1aa332fc8c75d5c34

SHA512
45d53a09ced29138e2f99e0e8a293322050f8032e006df06315ac9af2f1ab64d1c767ea5db53289bb5881a4866061299e5a60cd83753fe6ba88e8de7562706ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
9a7b9325f3ca79fa43424afbe9386d70

SHA1
6bb605a377e8dcaaef1fe5aacf2c9b63fa7ded34

SHA256
d94709ab9f905b71059e0ddd2736ca23458a65c2e4c68b034e9a3a811a4ecfbb

SHA512
d995b2ab36ffe47299dc1d45dd76ed6ca6a70246b08e302c7fb19fe1a5b22d416a974aa8e531e56597db86a51ded71f353efcaac3b0907ac6ac159ff2124295b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f2412f51eff2928cb867970470d8fadb

SHA1
28a234b7c7bd2f34ae49aefa2adc9efb993093d5

SHA256
7f620e4230413996edcac2987a62e52ea97cb6b2eebd201770b1120432db1dc0

SHA512
86361cc0133c4b7f4c537e41f4e17e77f42d3fa04b083fbff8bbe570acc7d2d159443f00859a695b3efe67c713c832adffd05b69db0e427c17aa387bb4cbc1cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
3056c76bc171ce3cbcc9e5306e8ec04a

SHA1
36f0056c1cd81caf8090d2536e316d1a669e5487

SHA256
39006e9ff4b2c330833ac6e101108a9e9c96c88ce3ae6d3b647dc88de02682c5

SHA512
73cf66bdba4dd06f361e6d366382c2dbd335eb4025079f332516e58e4793eb76436278be27c5fbb12bd67e43a7f7f19bd6e1ed91e3cd3c949733ecebd138ad55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
50564818f0a576429272a42ea860ce2a

SHA1
a2edc9c22123103f08b21bb6aac9c2a317419dd8

SHA256
466526d144c695c215d6adf2dceaffb9e25e987aa8756bc4492f11bb1775a75b

SHA512
045fa5a711581fbd6f03fd480987d4353dec992e0b33664fdac286a83909fecf2da0688cf25d84fa44869e1e71d849a8f6996a76b933728dc78cdb8f2f3df285

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3b2dd78e16fa7c9d97806e84fb6cedd2

SHA1
f1dd91ae87b3c8c17145fff1b91b73c6ba692b10

SHA256
9de35a0883ef3a52f6516915197e8db256a6a7734d5fbaee55e504d12f7e5d49

SHA512
6e46b547f2547945554b4ddff10a91aea7f115142f86df5a57244b328969e197b844c595e5574da0473c35b5de9e7fe6ebc0b0fbe767c4ac21d7bc167fb58dc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
7da2a3c3e9e083fd33a53f195c59e3fd

SHA1
00cb2c412d2c1c1ec8f309a4ad41f0fbbb1bec93

SHA256
ad077b2ff1f29034a55664ca7a01f0176db1a29e1b0f3c007ea85cab16172d0c

SHA512
ef9965a2b65b7c808b81cc3478e0c30a8b6f79550391bedd5dd25db79f68afca0e73e99032b42fde565158629b6af81890b4f5b8920f4e763b82e78dd503f956

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
af98880d4ec7c35455bd99a9d13b6570

SHA1
ed65323e79dfd70f60a9b40890d42e34052c7780

SHA256
ab7c1fc54c851207d99de2fee0edddd7e4e10b380f03957165a401ff3830cb10

SHA512
1f714fc59674c220e71f43fb78e891ace04c8605565cf6b767574ccf7acd0f45ddab717c330819025df85e5fd6a7eb473a437804429679c47a44c52b0a4b33ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
cdd502c52cd38a830d83eef610fef64a

SHA1
b183e63a842442f96fa75561c7c4d6bf0d1bbd81

SHA256
dc4f972f2f3aef9521a79f0cd43f09e32b3809e30bb9cfce61f22ea3f52f8701

SHA512
67e32ac6c1fc86e325bd72a231997894daf836d5bd47bd19126b4f6cf9e3cc8249806b399a611c045519184ceeb768d0f9b59ec12b3e1d50e17f6a7e8dfbbc5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
946ec6a227fcb09cf5de45c20ed78de7

SHA1
79fe996d4b9088bba763dc56adf94653b6787638

SHA256
4bd936a966dfde2201b39afe61d0b06930602e8ca8f6c4fbfe94216bb5db8ec1

SHA512
f67025fe7bfd1d729a854328be83d634b439455f14b79a7ea15665d9f891b0f5f7c8b6d1f4be9a0e7b6e204546cbdcfe6ec7976ddeb61e9f277af06c9974ba47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
e53dea93bd48e15d5d7b43403437f51d

SHA1
72eeacbc34681230f83abf9b590555a1e10f0fa2

SHA256
0a6639d7fc8d46de48f505e1e89c5ff0cc5f041ba2cade18956c9283e24460e5

SHA512
01b97d63709a0abbd85717490c55c2b7756d9922a695f0dd2dab1a89a8e4632944f643963d0c4a13704f8832dbb235a12e31e108588fbafd31215b3f1c7bacb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
e4be758848b1963c0bd045d9154d7f99

SHA1
4f0d1f8f96e095dcafc12ee05915b47f2eee35cd

SHA256
8d5c0ba6388d5053e04660fac7a62909357fe55749842e974d0acbe28fa2062f

SHA512
fb6043c1a3fc2e587fbde32f73dda2c69ad1cd266ccf3fc45dcf6d2de5fd94275be1c2abb9705a160b5d55cd99999377f3395076ae1d3528695ebb9126172882

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59b1f1.TMP

Filesize
48B

MD5
7f194b25051e232309a304f7681e6225

SHA1
c39d6775fb3f734839a036bf81c80911ca02ac64

SHA256
abc221cec07bbb521a8666e58e759206ce791d47a605eb2a3b2cfd2f7605e9ef

SHA512
7e13aa086b5bf35cc6db3bceeca4b5910d575402edf8a154d605fad1be42a4950222ae0ab3cd9da35ed78dffd92d580941a61ce7785f6238cd2297f55def208c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
84b986377e051e8259c5d08a91da1ce0

SHA1
614a3bb0371340502c8676daca483beef7e91db5

SHA256
915dc2fc528d9019c2e862d42114e5bfc5a1c10a63d9404b824ff5d6471eea79

SHA512
0ff29dba6486e7aa889fdcb65fdb187f5bf0e8490f56b6fa3051e914bfadc945799c6748bb6c430b2364cceae005ef17462c4eb31fef1569305c5db1d177d196

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
742cd1d6b89818e5f59a7c30bf882cca

SHA1
ffa63abc1e3c644f69422b013c711efaf88fad1d

SHA256
d1c412434aaf1fe60e48c9883e51269b5e1790f2ec4b8b182ebdccef77073d72

SHA512
df0070c672a9f65972b28871392c288368f37914307498463c22f254d6b5ed486cff4dee8d65aec2f6d364c6e5c4850dcfd9bad6c6029092ba41ea1d42141788

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
98KB

MD5
32666051106e998989aa29236ec1e276

SHA1
f43125ced646dd873d353050688ec9f357bf9db5

SHA256
7143fdd648570c60fdb08e821437368f1d0f79eed6f60c7d65bf57ce02660669

SHA512
630062e2e019b16c10fe4f8cdb77dd59bcc3ec36e65d4d60c832c9693b29678e19ce8abfb1bcab13513f210e6499463996f5216fc0ddb676e23989c3712643ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe599d8e.TMP

Filesize
98KB

MD5
82fc6b15d1e3a9cf4acfd3d6e70c6a52

SHA1
869d9df2304ace3cbecf84e46a4bcd77c58b53a5

SHA256
74204c9c4a9917fc150c455217034be656cf2b701eb4d76ebdb9e99a26e78573

SHA512
d2773d914855695513c2a89146cb2d06e4fc865e195e9041907c67e3f6403380b8dabdefd8a3c033879e6ebd529056aa9f9560bfa1caf7e4c862a6235a0a58ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe

Filesize
175KB

MD5
7db35fd06396a0b0bdb88bd9a2a0ecbc

SHA1
df6163dcc6334676203519ef6b829b645a54da3d

SHA256
56a405a8e20f284d69a5328772780195ccabd71a986847097c6a67b5aee10175

SHA512
845f1a36b6ddd7f50b6af1814ee8b11e659b4878c3779ea5bacbefec1952ec51a4e95356a27c0bb8ddd8cf1a1b57f3fdf5ac86343dc4e0a8aeb58d73f5534806

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe

Filesize
177KB

MD5
71af5df294f3e2b45d660395ba5edace

SHA1
aab8cc7e99ae91cb88ecce572f5a7681e39b40cc

SHA256
8b20802cad2b9941dd6bf04d2e880108f1f5e7287068d8083e5cf83ca8868d9e

SHA512
b9731f4d92249919d094ed8c497c42c3015ad264dadca19e2a6220806f0096ee3ceecf8384f08ed9d167a2fb43c8534e4931d976db3f3163babe6a7c32583da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe

Filesize
386KB

MD5
d561e9662e47cb335c475c0b02cf3fa8

SHA1
e1c415c6f05a12230626df3ba70ce9d993c1870f

SHA256
41b53254e184781eb2046ad20d6ebb86debb4a71e4060b11fa8cae390f46a4e6

SHA512
0661abd3c9cb95503906dab8ce745d25fa29716ccc1759ecbd71ec4221aae42d3172e999b7e9791faceb5a0033a64799ebc1ed74ca3b96c19ac835a634acc5a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe

Filesize
290KB

MD5
96c76110f0a06aca576e41d2946aa679

SHA1
c8101e51ef010ca070b0fb3344f113b7a28f726d

SHA256
90b67f8f9c30797c79ea9d72f7a48a0bdcaabea582aa4e456e36c53a228ff350

SHA512
2111642996794321ab041c09abd55155327e297056f81bdc9267098febeeee78fe833d65a0d18ae1a6e14faa72d35145e43c7426cfc0dc374bd71fd07bd57476

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe

Filesize
1.2MB

MD5
186b7e39c9b4c8564e5b4d46a42e01e1

SHA1
afc9eef190f840a85264945f74b24df48506fad3

SHA256
c7942f211cb72c6ed3c140e5998299ad05bbc5de7f30bee293ff9bdb4beb0782

SHA512
8558af7a811070871a66dcbc37aeeb52f75ffd0d813d2209aa12b3f308a9810cf435d01a7dea9461e75c72cf543bd198257f4378787a351d66935a9f33ed9c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe

Filesize
2.2MB

MD5
edfc943e6f14b5bb3473c8950f2601d4

SHA1
c8dc2f74c210a59f1defbe966857b9ce23f80269

SHA256
8b4e1a1938f998f444259792e4d7c59a3934514acf1bef35735665c84fd24226

SHA512
2b74575237ab7b3269084be9a7ac2ad5e23e6bb35532305f337df7f5284fe03c9bd4040fe800af586cb35ca4c758bb6adee0c7d7c9d04bd992c793f9f469949f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\D3DCompiler_47.dll

Filesize
493KB

MD5
a72f8a604f2577ee7b0aeff3b3328036

SHA1
846cd0a8d8a7275b3f4f377e398bccdb114fd0d4

SHA256
acef07d98d88f2cb0581f1050e788d2f02699346160d8e7a0a2b77b3a7bc83db

SHA512
ba2b03fad023694ca7faa8412c3725fa83200e63194554f97cc51f9a8bc804867deb1d534ce88072eba97d66877123a214cc80c589f0f578a211b3bafcada3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\chrome_100_percent.pak

Filesize
138KB

MD5
03aaa4f8525ba4b3e30d2a02cb40ab7a

SHA1
dd9ae5f8b56d317c71d0a0a738f5d4a320a02085

SHA256
c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7

SHA512
c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\chrome_200_percent.pak

Filesize
127KB

MD5
c050626f3f2b5f6421dbeee22b9d5364

SHA1
c23344622c94b36a6205fd3db6c5c8c05aac12df

SHA256
ce6ac7d329324b40ae57957f3a588c6a82f44caa8d7780adb328ef0804b59848

SHA512
5253fec6406ccc872752ad2edd0cf8e4a6eeb9ebdea86881a02922a6c9257323385b2f88645fa33a938ec0e568980ce8a227f9a36f883247ab0f2f3dab7159d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\d3dcompiler_47.dll

Filesize
190KB

MD5
50b6097c0e10609d976861efc4fee954

SHA1
59ec4674c1449426ed8858c081796ff3bf7943cd

SHA256
a1c56eb8858ae51fb661d304077ac840dea6335872008a99eddf60d897ed5498

SHA512
e27365965a25a4483f882384e2179b778b66a9af7d11e5cd3396856e1f6bd5a84cf27e5b06f23c11b3b3b50ef06e1c7a4c8117c96c886187c63491548bc5f7a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\ffmpeg.dll

Filesize
52KB

MD5
03b6ed9a4bab8273c4caba92c80104c0

SHA1
11f1743c718722433e0e7c4ed88aa7e60497b6d6

SHA256
3d759a8af9215d744a94a460a30a8099199d6400bc0131aa38b8ae6d570b43e0

SHA512
c05e181c255e9d14afd3d46f119e753f335aaae6d75084fd7fe8031eccdb08ac9e5523447fe9a11a486ecad11a92d1fcc7c19aceda7242fbf9f9910cf8a4a03c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\ffmpeg.dll

Filesize
246KB

MD5
b95a96e021a7ad0f8ce390fd04b52318

SHA1
8df812b7e014a16fee866d6f743b36a42106e40a

SHA256
1b1c3258eb442f80889b894dd5fa4bbd2c39f11c4b3a373586ca18f0dd564240

SHA512
91d34e72188a1dc7b7490747fcf6820db122c4d295fd9ccd99e975adb53d5f1c79c0cb75aefa0eb6ac3a4a48aebd60658001be6620bd993b4472e253f6ee94a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\ffmpeg.dll

Filesize
351KB

MD5
9dcc7576ed9b99050e89d29325085869

SHA1
ada6a7dd449e42735f7718a4d9259f446648f113

SHA256
f166ceefa1ae973ad2b8d886e68c99db3f4ea3fb0fe85df65f56863cf850003c

SHA512
4363de59bb6c29cb4526c775beebf6c9a5ea6a805a341c7a1945be281326c43fcbbffa27aca01d4fb0e04e199da5b4edbb6c6f38e6810afb49a434e50325a783

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\ffmpeg.dll

Filesize
1.7MB

MD5
cb04e3f0a5b6367f6d31b18f53feda7c

SHA1
d9cf58d69718f0a10a1122baf8aee47f51de4c57

SHA256
00b3c349249be242bfc4687db619b65a10fc1e5125dbd4fb692c56187079c17a

SHA512
735e374a755e8d4bebac8917e303d2c50aadb9601d53ce5b825503099862401e249a5520c3448ff919b444bc89e33840dab834e216a60256a060ecec4d667aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\ffmpeg.dll

Filesize
1.6MB

MD5
544d8d5925da7c8998c5108e37e96533

SHA1
98393882da7becafc7ea6e66d19e1a0429a87c7a

SHA256
b23fb032f83a5e70c94b6f3c44d45bd8cf4fa5d1c8c843deb68d889a5dd72ed3

SHA512
f3339988b3d72180f1e2b2e01a5ee7b928990ae85f0d8d9f8a5e51aff3d122962744f2ca9de9ded778f150ca5e130193e4acdf27093fb27bf0ffa0527031e688

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\ffmpeg.dll

Filesize
429KB

MD5
b6a2032712018a4807e2290aabe65657

SHA1
4084171d1f6ec367854d6a8c6f7e15554e0f5ff1

SHA256
e93246ed589eb2c29914fb1029e8d14f64e706f9d59f01bb61250193c6d08eb9

SHA512
b18d007487edbbb043b6c9a5efd08b326da4d6036188930b5253320eb7ca21979e84d23669c7c2b356da3c502b3b4414d4eece441fca27622e2834c386b5be76

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\icudtl.dat

Filesize
595KB

MD5
2a3ce7a2859577586203289255a12fd7

SHA1
f4e5ad2d3baca1029017f358d79f646f9301807b

SHA256
2a96e38c1c0e607a4fc74bc1ecbaa344786730141e9583534dbe11ae46fa2483

SHA512
c6c1a466238c91450f0c59cdbb7205560b6f0f5e6aade45c206810e23656117bab197f7af544b52fc184f8ce38ef18a4a1b8406ddbb003f650f4a8a55c5409a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\libEGL.dll

Filesize
346KB

MD5
dccd99cb80c5022d4ed21c068d4e4ae5

SHA1
4fcdc6be313d0e3baa5168a7556df992e3364da4

SHA256
2166f8830bfbf3d574d7654bd927fe6e05fb74fb05d8e57af59c93090f6bc2a6

SHA512
02f18a691d85545a0452631b1c1e218aa5853d71937f7ae1d4f3639142399017139c1d9cb81f769754303635ce689605a7fd65765a3d8b4873603ced57925faf

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\libGLESv2.dll

Filesize
305KB

MD5
18655b6a353549cc7b8bd867e90ed9b1

SHA1
c931656949d1bdbfb7f02a395c32eb7dd42ec4c2

SHA256
59f5c6dff2bc779e80b87145990339a687d7f7da65735a99fd2552176255e79f

SHA512
46151f56e97245721dcab03f7cae4ee900aaac575e85c81b7fca86a9496abc3aac7901dc4782f7bc2ef93a8692aeaf35ed8a8ed1ff984cc1de3a488567743fe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\libegl.dll

Filesize
167KB

MD5
679a9fe84f802829d557b02d4da75828

SHA1
b1b14ecc556531f8861c325ff52b95a6e1550e07

SHA256
a08bec0f091939029a8e5ea5430c305bbc52484ca2e6d67b963ab79cd0f8e718

SHA512
d51001c6e95499922fc31e4512293466fdd5e26ddce91bc8fc047915934fb972f69d546ae47484c03f83a99cb6fffadaf73f860b75e8993afbb31ff4eb5d00d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\libglesv2.dll

Filesize
60KB

MD5
0e44cedaf32a4801d840641852c7a4bd

SHA1
cf0e6888be7b1d5acd0da21a05dbd41600b4c26a

SHA256
fefa520ff2df0d80d2f98516098877161b7f6b0f83787b138e9c630ad38e9d58

SHA512
3f6f7fcf0f5f736115dcbdfaa8c763d15325f64da938d65723233ced766eb3ba5698dabae4b2c0fa9b3cd3e90c2ff74f3c03a591a4dc0a548a0e4841164d3bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\locales\en-US.pak

Filesize
88KB

MD5
af5c77e1d94dc4f772cb641bd310bc87

SHA1
0ceeb456e2601e22d873250bcc713bab573f2247

SHA256
781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4

SHA512
8c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\resources.pak

Filesize
232KB

MD5
50eb649318bbb406d6a1e336cdff7f97

SHA1
50f470f977844b0df6e620eecc2191061677a718

SHA256
fa16f2af30c9545ab9c9cf8aa8315d047c913062194bbfe9d38c1beae4648bb4

SHA512
44d74b2c49e6de3d41db5a650864d7e0a998d313084ad13e3b773101cf31bac987995a8a644dfd65370b5e3f32da731c9c252c99513fd47eac45118fbe1a37ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\resources\app.asar

Filesize
195KB

MD5
22b252289961a5f1f7f8e547d9f1a720

SHA1
8fd60ba3feea7750cb2438faa0d661e4f0384d4f

SHA256
3b689826185e4c41c85784da82d5b4681b502a5a7f565b50dc3a652a9b52937f

SHA512
8c4941b051386b422a38f7045247067aeb77082f2e1f49f3b106fd42f3084d8dce0f7b9d24fea9886ea9844086bc94774a69d4132c02cd98edade830c1ea360e

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\resources\assets\images\background.png

Filesize
297B

MD5
32338b60ff8368fd431b32109eae89d2

SHA1
7a3a844f2e6371c8f3a08a142e2e792a6e77105a

SHA256
1d370406c3b0c6bfe109feb76229fd4a0fe1d4171ae2a77655a0fd3264558d2f

SHA512
be71b3dcc24cea203d59e08d8a4082dcf253eb02a971e67034f8cc0930f6af72830b1e35430cc861c08341082156585adcedcbfc788a83ec35fbd78107e20f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\resources\assets\license.txt

Filesize
2KB

MD5
f31549cdc3abfa48981759862a07519e

SHA1
1168fdb04883a65057168eaccb75e153aa3fe438

SHA256
267c8e6f5387fa5d54290044d30a5da427be3597fa7815c32689a533eaee8886

SHA512
f084f518eafc6a58c377c3f80d8a186d9a1d55473afc931bb913adb1fa6fd0bbbc2ba09a30ea39283cd5327079278ae7babea6a74b93a7f2d7cb48bfbba95795

Download Submit
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\v8_context_snapshot.bin

Filesize
161KB

MD5
d88d23551a4d7230f98fe0cbd363695b

SHA1
8e28eb4153e00aa5345bdb539b925a777588a26b

SHA256
72c3c123f10eb6e24c83ee40727a3a632cf7a8b062a3b7c7b41db4bfeda52ce4

SHA512
ea757e91c7cfc766b35da226263e82646f5b1153b8800c5cd69321d98b6d424413dcd7a02413a6a0e2f34905daf84bd21302b7ad58f2ebd814a7ac0a92b9d284

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr7E1A.tmp\BgImage.dll

Filesize
7KB

MD5
487368e6fce9ab9c5ea053af0990c5ef

SHA1
b538e37c87d4b9a7645dcbbd9e93025a31849702

SHA256
e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04

SHA512
bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr7E1A.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr7E1A.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Roaming\BetterDiscord Installer\Network Persistent State

Filesize
175B

MD5
2b7e4377653e6e07536efe7fc1bd78a7

SHA1
cdd9c03b91e368bc14c4ac0ff7204ee698fa285d

SHA256
bd367325bb3c469e1aa6dcff50b6296b9b8d5bf5bed538f01f36c29b0603511a

SHA512
5dae5ba1af5ae6e52a39092bc5b4ebb454906c919735ab5b7f7a4c84a487e26376f68aee9c86265142e03c0f163cc0623094fa4f2936bff17504c2059ba112dc

Download Submit
C:\Users\Admin\AppData\Roaming\BetterDiscord Installer\Network Persistent State~RFe58ad14.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\??\pipe\crashpad_3612_TCXJYFEFDIBQAMPL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit