ccd1b73aa774e3deefb7672629099eec167b130521b9036b553af6e46ffdbe3f

Analysis

max time kernel
1169s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordSetup.exe
Size 94.6MB
Sample240403-x2vfvsab91
SHA256 ccd1b73aa774e3deefb7672629099eec167b130521b9036b553af6e46ffdbe3f
MD5 c08f6fd1027cf7216bf6a4bb94a7e54a
SHA1 83f3d43ddcbe887144ad804bec9527bc36b56b49
SHA512 2f9f6b61750bdc95df74efcd735cf4696a23dab40b1fb0c799a0ba5fc02a08610c0925c3710cd70a99bf9a0a09e69fb934a80c3dd5e773d50ae9598d169fb06b
SSDEEP 1572864:hYLmKqR1jtc9bcgQxZYuxsQZonARqnz2a/XmC+fpjPkkyuJzI886/GJ+5lGoHGw:hYLmKYc9beZFh8z7/2xPW6+c7G2Gw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	Discord.exe

Executes dropped EXE 6 IoCs

pid	Process
212	Update.exe
5092	Discord.exe
4808	Discord.exe
4012	Update.exe
4368	Discord.exe
624	Discord.exe

Loads dropped DLL 8 IoCs

pid	Process
5092	Discord.exe
4808	Discord.exe
4368	Discord.exe
624	Discord.exe
4368	Discord.exe
4368	Discord.exe
4368	Discord.exe
4368	Discord.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9039\\Discord.exe\" --url -- \"%1\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9039\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Discord\DefaultIcon	reg.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
3924	reg.exe
4940	reg.exe
4148	reg.exe
3400	reg.exe
1028	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5092	Discord.exe
5092	Discord.exe
5092	Discord.exe
5092	Discord.exe
5092	Discord.exe
5092	Discord.exe
5092	Discord.exe
5092	Discord.exe
5092	Discord.exe
5092	Discord.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5092	Discord.exe
Token: SeCreatePagefilePrivilege	5092	Discord.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
212	Update.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 212	4640	DiscordSetup.exe	89
PID 4640 wrote to memory of 212	4640	DiscordSetup.exe	89
PID 4640 wrote to memory of 212	4640	DiscordSetup.exe	89
PID 212 wrote to memory of 5092	212	Update.exe	94
PID 212 wrote to memory of 5092	212	Update.exe	94
PID 212 wrote to memory of 5092	212	Update.exe	94
PID 5092 wrote to memory of 4808	5092	Discord.exe	96
PID 5092 wrote to memory of 4808	5092	Discord.exe	96
PID 5092 wrote to memory of 4808	5092	Discord.exe	96
PID 5092 wrote to memory of 4012	5092	Discord.exe	97
PID 5092 wrote to memory of 4012	5092	Discord.exe	97
PID 5092 wrote to memory of 4012	5092	Discord.exe	97
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 4368	5092	Discord.exe	98
PID 5092 wrote to memory of 624	5092	Discord.exe	99
PID 5092 wrote to memory of 624	5092	Discord.exe	99
PID 5092 wrote to memory of 624	5092	Discord.exe	99
PID 5092 wrote to memory of 3400	5092	Discord.exe	100
PID 5092 wrote to memory of 3400	5092	Discord.exe	100
PID 5092 wrote to memory of 3400	5092	Discord.exe	100
PID 5092 wrote to memory of 1028	5092	Discord.exe	102
PID 5092 wrote to memory of 1028	5092	Discord.exe	102
PID 5092 wrote to memory of 1028	5092	Discord.exe	102
PID 5092 wrote to memory of 3924	5092	Discord.exe	104
PID 5092 wrote to memory of 3924	5092	Discord.exe	104
PID 5092 wrote to memory of 3924	5092	Discord.exe	104
PID 5092 wrote to memory of 4940	5092	Discord.exe	106
PID 5092 wrote to memory of 4940	5092	Discord.exe	106
PID 5092 wrote to memory of 4940	5092	Discord.exe	106
PID 5092 wrote to memory of 4148	5092	Discord.exe	108
PID 5092 wrote to memory of 4148	5092	Discord.exe	108
PID 5092 wrote to memory of 4148	5092	Discord.exe	108

C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe" --squirrel-install 1.0.9039
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9039 --annotation=plat=Win32 --annotation=prod=Electron --annotation=ver=28.2.7 --initial-client-data=0x510,0x514,0x518,0x504,0x51c,0x888800c,0x8888018,0x8888024
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4808
  - - C:\Users\Admin\AppData\Local\Discord\Update.exe
      C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
      4⤵
      Executes dropped EXE
      PID:4012
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1900 --field-trial-handle=1904,i,18036150371004977503,17095552018272618889,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4368
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --mojo-platform-channel-handle=2336 --field-trial-handle=1904,i,18036150371004977503,17095552018272618889,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:624
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3400
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:1028
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:3924
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:4940
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Discord.exe

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\Discord.exe
Size 134.5MB
SHA256 0ee2942b11493f4947a2b1e244c34acd4f1f00b0677c91f9a07557ac84cb0774
MD5 8da0897af3eb019033f585bd8e64b296
SHA1 287de02175312f99f536ee2b26a152903eaae2e4
SHA512 1caac9456db6796164531cf1f031162e280a24612cde57b16bd715d8308ddfb45e715cc4605da216a032f98abebc59058d813ec5869fe9a39bc5677ab9fb9a07
SSDEEP 1572864:krJoDyqRjOL1S7PHi1Wjs/H4ZV3prMDqPmlPcgoBKoTGXEWt0ikuVTtchv+pvdEW:mKqS7f43dqOyVb0+6HlRNx97I0
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\chrome_100_percent.pak
Size 163KB
SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
MD5 4fc6564b727baa5fecf6bf3f6116cc64
SHA1 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
SHA512 fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
SSDEEP 3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\chrome_200_percent.pak
Size 222KB
SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
MD5 47668ac5038e68a565e0a9243df3c9e5
SHA1 38408f73501162d96757a72c63e41e78541c8e8e
SHA512 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
SSDEEP 6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\d3dcompiler_47.dll
Size 3.9MB
SHA256 2438b520ac961e38c5852779103734be373ee2b6d1e5a7a5d49248b52acc7c4d
MD5 08ac37f455e0640c0250936090fe91b6
SHA1 7a91992d739448bc89e9f37a6b7efeb736efc43d
SHA512 35a118f62b21160b0e7a92c7b9305da708c5cbd3491a724da330e3fc147dde2ca494387866c4e835f8e729b89ee0903fd1b479fcc75b9e516df8b86a2f1364c8
SSDEEP 49152:pS7/Q+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ij:p4/hqqFVUsLQl6FqVCLTzHxJI9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\ffmpeg.dll
Size 3.2MB
SHA256 7c1749d47f64a46b2f1e658b99083b5444f1f405da6125f10fe335059de7a10a
MD5 55edcca632b1a22e36d348932765600b
SHA1 8570a38b48b90bfff3a0bce4771d80a1668dbc75
SHA512 f30d3b9a05ebece5c2997c5b9f055ccf3fa30f929b2039af5d8c72f15b11a996acb669f51800d9ffd3409d7705caf807ddba374f72735e010bb57d6023b285f6
SSDEEP 49152:ZiNJMIJMsqVaYl/RqK1+Rhca42mipyYx/SjpKC5QqfNghupLno31bBJ:ZiNJMIJMsqVBqK1+Rhw2mTYGjuSLnKX
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\libEGL.dll
Size 376KB
SHA256 3eafdd2a558f1110606e4c95b5f2efac0536bb0005d5bd9f68957d3e866771c6
MD5 42c5ffe970aa12c10e5a45f837a033d9
SHA1 0b0d82cebe169768c892c7bbfcc0346db47da4a7
SHA512 83de7c9638ac8e6ac2d34c87917dfc8aa309dfbec54e56b327384a47d959ce53207c2c214a2a42f44a6f9c524448f0cb405cbdcf9319f70a616da332dcaac0f5
SSDEEP 6144:Ill2N2/chkPSzWRVqLTb3TIDNmqf/xMzCeEpz2auh6Y7VtAeyp4/L:92/ZBMLTb3TIDNmvUz0L7JL
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\libGLESv2.dll
Size 6.4MB
SHA256 53cd9f341abe29b5b53c58a9060087551685385cc18bf5c8c25b54cf8773d499
MD5 5dbf4a2b443fbe52d9b80511ea0b94cc
SHA1 a4a3d31f9d2902c455e9e5e1fab931fd6108272e
SHA512 e30aaaaeaf42250b45d8a867352af6aec33dd81bbd7eeb72fae17f6a8050cf7aeacba9ab08c3a5ea489a030738474909d97210f56f0222165b8c9a645540514a
SSDEEP 196608:qKnzXoC8dmco+LtGJWrpoxUnlf/BYWaDh:qazXz8bLtGJWrpkUnlnBet
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\locales\en-US.pak
Size 428KB
SHA256 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
MD5 809b600d2ee9e32b0b9b586a74683e39
SHA1 99d670c66d1f4d17a636f6d4edc54ad82f551e53
SHA512 9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431
SSDEEP 6144:5GdVxPtFXqVtOMP9eXe9HfaYvaVP51SLngF/cjjwB:yVpwOMge9B251SXjwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\resources.pak
Size 5.1MB
SHA256 546456d9a1328836a99876824f3beb7279f38403cd001515f5d9eb204939e57c
MD5 e9056386a2b4edac9f0ffa829bc0cfa0
SHA1 f8d4b8289ebb088c9997a1fde1c2f12aedd6c82e
SHA512 c49e832e5c16a1846ea882395e83f9cbe9f4f6b44be9f0c7276d0a4495b88091bd95593c5e167dba853834058d7ca823db60d2fac73434ed952b7064b2daf6da
SSDEEP 98304:pt1j254CJgWPVcz+cd31rJ7JBXbwHgf31/LrwrWBpcdmTHWCF3UlfPcauPFcHNp:ptp84CJPdB831FJ5wHwlzkrWBQmTHWoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\resources\app.asar
Size 6.3MB
SHA256 3674c0eb2a447e6449ba819e04d493a1f4284c587739f0611a19bb4ab236ba65
MD5 a3fae9e385d9b80ea269c68bbdb97e41
SHA1 e5ab851e94104edcf4751b1c1b4312dbcfbf8214
SHA512 a5cf45bae5c9ebd397504ccac18d3187a6034c1022b62bd7780f070460f8fb6d44aee08e1af964bd4cbcfab3c6263d8348740274a81f16483b6a4d76b2c73a2b
SSDEEP 49152:/FlHzbN35leYpNQ+l5AK71AK9CgJUjzmguUJgdX4QNhAejRmf4vjRmz4yjmqnMB/:/3lb4QE4O4yooAUo46/
MD5 SHA1 SHA512 SSDEEP

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\resources\build_info.json
Size 83B
SHA256 415f673c0b3933f8bd08e30421b85f0d75f2f2339bd3e4a29f85fc5c7c98f457
MD5 2975d2275891f5984e461bdf7c5ac170
SHA1 c324f18d726e6591e56b2117703b2d23e1d335df
SHA512 31f50d242ab3cd59fea7ebc22368f6b42574602ee5abd2905ecc3722cf40fad590c30028e6aa2c2b2be64d5954c09086bdb89900e8d47e3f60ab5dcd1e2a1e28
MD5 SHA1 SHA512

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\v8_context_snapshot.bin
Size 631KB
SHA256 457167b96cf7cb9d80bf5f74976314b465439adb0563ed820be15d848f3daf66
MD5 5e59b98c444e66f981b8605636e88efd
SHA1 78ce5d12ef8d76e5de09873eec59657a5b3964ee
SHA512 9401047fb86cd7d9b9aeea72bc3b7981b834e914d7ecc19ef2f787ccf946548a95241b89d508372caad6a7cc157e2be6fa931d952f836404b7c0c5abe4ca614b
SSDEEP 6144:AkYTHD11/F4gPrUqKJKTXVksm1kpTKqwRnmpkdXF:gHnPrtcQ29nPXF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9039\vk_swiftshader.dll
Size 4.4MB
SHA256 0c75f2949da407561083ab79a3122152f69aa1ceb6d4df919fc2a277ba56c33b
MD5 d045ce8fac358f6ca98e61ea86787f67
SHA1 71ce4486853720deaa43df67c1768e93e76f57c0
SHA512 273308a6e0b094171aaa1cf445ef88c0449b54be69529532fcbe91d6742cac28ff5145f482130f9e7f2f528899bd4844d05e9c51b70e2334ed420e2e31d19fee
SSDEEP 98304:v/VTi73obtMtc3TjfRfDTgxz6+ixb684YnOL7pMHPXa3SMdAkFE9V45SeOlH:t3qtd6+i9rI2HPDHkq91
MD5 SHA1 SHA512 SSDEEP

Submit Download

Discord-1.0.9039-full.nupkg

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Discord-1.0.9039-full.nupkg
Size 93.7MB
SHA256 41f3d369df1e1412dc5b6eabd03a0912fc94628f3c78346d4f31950925ed7b2c
MD5 f6d21fe975682d7d6b33dda9c7006892
SHA1 3f219786844dcfe32c239d21ca36d38c6d6672c6
SHA512 1d3c603c9f6d9896b01457a97f3455d8abd3bf6d9523c880508d9f984bf4d1b9f7139da03cbe74dbf7264f9e5ecfe1467875209613dc7c32b1e08fed6a17c1d1
SSDEEP 1572864:2V120tCsxFfq5jeW0Dc5QK8YKRoreb4VuB/IMKdmNqmM8jhW2vcFiQXYALZTGFBc:6120tVnq5jFmKIEE9JKwqUc9TuBQbHD7
MD5 SHA1 SHA512 SSDEEP

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 80B
SHA256 a5597ddbea7f4a6719f343e223520fe4b5385e3a9da12de043c48d7e6353c93a
MD5 08cb640b720c5d7b6fce3da10cff52df
SHA1 27eaf8eef5d4b0a0d7231fefb0117f5ef05b6b84
SHA512 6dcfaa05a0e9377b01541117e70246cd35d9029b219f7bdecdb5b7db61818b1ffb24dd4345067f89a1630f5efbffe58e8be31821ae09418d0af4850c9e3d8b3d
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 efc81c7e0c2df31b7f7d79910aa2129703d6d19771e74d0978eecd84a0f4c8ef
MD5 f41538e41528534513d514dab4766ef1
SHA1 c12f27a11dc965097768760ca89521f18b6f88bb
SHA512 b23319ec5fbcaa07a67d7bf5697653d867e56c9d83ed9134c7403ed4f26637ecf0c72024c26898926d88581b02c89a6877f012a7940202e82e9b9fd0ee01a6f0
SSDEEP 12288:06CyLEgR0ro/0EhcXAHjRYSN9bUlOr/oJfT9Pu0XejfQ1JRQ3Tzvx+nDIpnUu:lEgRN/th3VelBPu0XUfWJms0pnz
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/212-198-0x000000000FE70000-0x000000000FE78000-memory.dmp

Download

memory/212-200-0x00000000106D0000-0x00000000106DE000-memory.dmp

Download

memory/212-199-0x00000000106F0000-0x0000000010728000-memory.dmp

Download

memory/212-11-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/212-201-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/212-10-0x00000000744B0000-0x0000000074C60000-memory.dmp

Download

memory/212-9-0x00000000004D0000-0x0000000000646000-memory.dmp

Download

memory/212-318-0x00000000744B0000-0x0000000074C60000-memory.dmp

Download

memory/212-319-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/4012-225-0x0000000005020000-0x0000000005030000-memory.dmp

Download

memory/4012-229-0x0000000004F80000-0x0000000004FA0000-memory.dmp

Download

memory/4012-224-0x00000000744B0000-0x0000000074C60000-memory.dmp

Download

memory/4012-294-0x00000000744B0000-0x0000000074C60000-memory.dmp

Download