5c87df642a1e50ca1c32b3bacec7f50b5d1341ad25b6bf028d4b529ceec2e1cb

Analysis

max time kernel
120s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordSetup.exe
Size 91.7MB
Sample240404-kd18aaad3w
SHA256 5c87df642a1e50ca1c32b3bacec7f50b5d1341ad25b6bf028d4b529ceec2e1cb
MD5 13a353f387115f4c2ddc79be7b41caab
SHA1 7b24d6fd78adc0dfbedfde5992b8f76aeab44920
SHA512 255b7b11bf861f0c2f8d17c69368e2ec865f97b151bfb6e6aa649a309f8f68db6a0ff5e80eb74eaed22e64036e25888dd6c4d9ae60453c28e91414085d1fd886
SSDEEP 1572864:vdqw8JWjnIPLggoQZKSchY8upx41DHE1C1AqfQfLApotdgXggcdUEou:Vvyggo7SchgpCqqfaLApGPgc/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	Discord.exe

Executes dropped EXE 6 IoCs

pid	Process
2808	Update.exe
2548	Discord.exe
5008	Discord.exe
1252	Update.exe
1680	Discord.exe
668	Discord.exe

Loads dropped DLL 8 IoCs

pid	Process
2548	Discord.exe
5008	Discord.exe
1680	Discord.exe
668	Discord.exe
1680	Discord.exe
1680	Discord.exe
1680	Discord.exe
1680	Discord.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9036\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord\DefaultIcon	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9036\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Discord\URL Protocol	reg.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
3484	reg.exe
3084	reg.exe
2312	reg.exe
4452	reg.exe
1892	reg.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2548	Discord.exe
2548	Discord.exe
2548	Discord.exe
2548	Discord.exe
2548	Discord.exe
2548	Discord.exe
2548	Discord.exe
2548	Discord.exe
2548	Discord.exe
2548	Discord.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2548	Discord.exe
Token: SeCreatePagefilePrivilege	2548	Discord.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	Update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2808	3024	DiscordSetup.exe	85
PID 3024 wrote to memory of 2808	3024	DiscordSetup.exe	85
PID 3024 wrote to memory of 2808	3024	DiscordSetup.exe	85
PID 2808 wrote to memory of 2548	2808	Update.exe	86
PID 2808 wrote to memory of 2548	2808	Update.exe	86
PID 2808 wrote to memory of 2548	2808	Update.exe	86
PID 2548 wrote to memory of 5008	2548	Discord.exe	87
PID 2548 wrote to memory of 5008	2548	Discord.exe	87
PID 2548 wrote to memory of 5008	2548	Discord.exe	87
PID 2548 wrote to memory of 1252	2548	Discord.exe	88
PID 2548 wrote to memory of 1252	2548	Discord.exe	88
PID 2548 wrote to memory of 1252	2548	Discord.exe	88
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 1680	2548	Discord.exe	89
PID 2548 wrote to memory of 668	2548	Discord.exe	90
PID 2548 wrote to memory of 668	2548	Discord.exe	90
PID 2548 wrote to memory of 668	2548	Discord.exe	90
PID 2548 wrote to memory of 3084	2548	Discord.exe	91
PID 2548 wrote to memory of 3084	2548	Discord.exe	91
PID 2548 wrote to memory of 3084	2548	Discord.exe	91
PID 2548 wrote to memory of 3484	2548	Discord.exe	93
PID 2548 wrote to memory of 3484	2548	Discord.exe	93
PID 2548 wrote to memory of 3484	2548	Discord.exe	93
PID 2548 wrote to memory of 2312	2548	Discord.exe	95
PID 2548 wrote to memory of 2312	2548	Discord.exe	95
PID 2548 wrote to memory of 2312	2548	Discord.exe	95

C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe" --squirrel-install 1.0.9036
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9036 --annotation=plat=Win32 --annotation=prod=Electron --annotation=ver=22.3.26 --initial-client-data=0x54c,0x550,0x554,0x548,0x558,0x8295d78,0x8295d88,0x8295d94
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5008
  - - C:\Users\Admin\AppData\Local\Discord\Update.exe
      C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
      4⤵
      Executes dropped EXE
      PID:1252
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1932,i,9697747500170291915,16327424227216231857,131072 --disable-features=HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1680
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2064 --field-trial-handle=1932,i,9697747500170291915,16327424227216231857,131072 --disable-features=HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:668
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3084
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:3484
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:2312
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:1892
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Discord.exe

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\Discord.exe
Size 130.2MB
SHA256 ac258f1ed44807eb0ed0c636919ae8f59466598d5476c7e09963f11b3a32c23c
MD5 a43cdd5baac82037007288d8bee913d8
SHA1 818ecdff89201dccd56e03a2ae7e84f05575c7e6
SHA512 1fca1dae950a24ebaa5a837b5180f2d8bd8e8945321da94b36c90591dbd74f7a23d87aa5118ff3db617552e88e06811cdb74aa34e5ef39151160cd82bc6dffcf
SSDEEP 1572864:joU7r/WUpViKFZ2Iliw1Kqc4Xs9SpDeaVvKGv9w4GCh+hqHqblgKTZfRVbYTsJho:W6VdeacjCh+hqitdbb/B1VlCUO2Vix
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\chrome_100_percent.pak
Size 126KB
SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
MD5 d31f3439e2a3f7bee4ddd26f46a2b83f
SHA1 c5a26f86eb119ae364c5bf707bebed7e871fc214
SHA512 aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5
SSDEEP 3072:5KzwqCT4waJL2myFhPNL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:5Kzwt4LwmU3K18Gb0OV8ld0GecQ3f2
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\chrome_200_percent.pak
Size 175KB
SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
MD5 5604b67e3f03ab2741f910a250c91137
SHA1 a4bb15ac7914c22575f1051a29c448f215fe027f
SHA512 5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d
SSDEEP 3072:+DQYaEQN6AJPRJL2myFhPNafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:+DQYaNN68RwmU0gx5GMRejnbdZnVE6YR
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\d3dcompiler_47.dll
Size 3.9MB
SHA256 2438b520ac961e38c5852779103734be373ee2b6d1e5a7a5d49248b52acc7c4d
MD5 08ac37f455e0640c0250936090fe91b6
SHA1 7a91992d739448bc89e9f37a6b7efeb736efc43d
SHA512 35a118f62b21160b0e7a92c7b9305da708c5cbd3491a724da330e3fc147dde2ca494387866c4e835f8e729b89ee0903fd1b479fcc75b9e516df8b86a2f1364c8
SSDEEP 49152:pS7/Q+besnXqRtHKzhwSsz6Ku1FVVOsLQuouM0MeAD36FqxLfeIgSNwLTzHiU2Ij:p4/hqqFVUsLQl6FqVCLTzHxJI9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\ffmpeg.dll
Size 3.1MB
SHA256 f882717125ec8889172c64bebe56430b60c1b706b50692ff1edbcc899c65378a
MD5 37977edc649ec543710b4cdb567ce9ab
SHA1 f3351235162e9673c414084027061ffe6caefdea
SHA512 22bb33fa1ab5bfe435763ef677ac04af66d97cada4ceef416a434a6cd13f962a104669653c7280cc21f563178ce050e12b0054d0f0257ac91ff8eb18fc9efcee
SSDEEP 49152:DcZGdCGdsEq9RpoMIzG5j7RDPdK22TEnaUZCOjE/TrvlWyO3YayAHYLoTggb3f:DcZGdCGdsB/py2VaUUOY/P04LSpf
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\icudtl.dat
Size 10.0MB
SHA256 97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3
MD5 76bef9b8bb32e1e54fe1054c97b84a10
SHA1 05dfea2a3afeda799ab01bb7fbce628cacd596f4
SHA512 7330df8129e7a0b7b3655498b2593321595ec29445ea193c8f473c593590f5701eb7125ff6e5cde970c54765f9565fa51c2c54af6e2127f582ab45efa7a3a0f6
SSDEEP 196608:p5zwSv9AAyse6liXUxCGZHa93Whlw6ZCXU0:pyKlysTliXUxCGZHa93Whlw6ZCX1
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\libEGL.dll
Size 394KB
SHA256 f7124b3812a67d0d3628b849deb5c913c339d94863eb178183563adc161d5f59
MD5 1dc9cd281f2d77bac45a41e7a2181707
SHA1 44e5ab9602ad1ca53930a12e8868bd7894b30749
SHA512 16cdff34a114a2d267109e4f3a2b12c6cf7253cb19a36924c711d45c579ef51e2de43175b98a85996a7ef383cd7fc07690024da44176fabbe967e811faa8279e
SSDEEP 6144:w5p6qTYUcbaMFD7M8hK1O2e5KkAKIMZPSZJIP/:uvTSblm8hK1ZOXNPSZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\libglesv2.dll
Size 6.4MB
SHA256 14367059a17a440621a747f62b0008e199ba1bcd4de0dde8636a6c0629b8aad3
MD5 5fa374fcb6ce1afbee19b47a94d7f0bc
SHA1 9529954cdb58bfce6eae4d868f0ff0102cfb422f
SHA512 1c288412d7b99b7edc43ff8d016cdb5c25c91d06cafdf5dc8015e8b0f2dfc29e9adab24a17224937c316b9ad1b01c57b46b526173fb65f82c0bdaa030d381f54
SSDEEP 196608:9NtQrp20oWAyqiq9RcMDBtC3rS4+4UJsht2:9NtQrp2uAypq0MDBtg1SJT
MD5 SHA1 SHA512 SSDEEP

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\locales\en-US.pak
Size 313KB
SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
MD5 3f6f4b2c2f24e3893882cdaa1ccfe1a3
SHA1 b021cca30e774e0b91ee21b5beb030fea646098f
SHA512 bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c
SSDEEP 6144:SssphRVKuQ+KVMP9elsY4ZfaYe7RqIZ5HS5xswS:JsIvVMNY467Rv5HSPswS
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\resources.pak
Size 5.1MB
SHA256 c8895857a61455b2b2beca23f6d400d29fe1685666bef79f11385a3485d24628
MD5 3b20663d297fe4175c62e07df022d436
SHA1 03e57b5fd5d33eeec5d510c5382a263b4514c306
SHA512 ddebaa58495c93ebc282b27bfa883eebc36048707ad779f8557eb12683c38f1db9be8e2f96257456aa6ce6b26e8d639dc28783b6cddc92d294219ace66c9134f
SSDEEP 98304:3efgvjXBYrINBibFPzG/7DN7h1rg0Z0rwreQVnHbwJwKgoHksnR:3eIv1YrIzAq31hqi0kreS45JR
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\resources\app.asar
Size 6.3MB
SHA256 cba83099ca964e43d41d4dc027670ac6298ce3d7fee2b8db8850e5714599853c
MD5 4854db7760a03976ca612633eadd65ba
SHA1 f423c27c02781b3468fdc6d6e779c3fd5d339097
SHA512 79950c9fb19d59b43319b4d660a70b8f4ad2086e353beab9b218a4c28265b30c333120ad46ab3e36e43fa6079e80e020f23e858e7235e088fe9e4486f0c396c2
SSDEEP 49152:dFlHzbNv5leYpNQ+l5AK71AK9CgJUjzmguUJgdX4QNhAejRmf4vjRmz4yjmqnMB/:d3lj4QE4O4yooAUo46/
MD5 SHA1 SHA512 SSDEEP

Submit Download

build_info.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\resources\build_info.json
Size 83B
SHA256 f09b3331ab97c2d4eb403e559d48f1f5df6d19f6d3e674d7b90e5408a916eb7c
MD5 04cd752b220c69bf914886d76fe7f977
SHA1 743bd0f9492c0b1c60e0eeba8263692ca7f91c7d
SHA512 ef3cfa793d227ab0246ecbf9870a685d7e10da676990f0343319e6895494d1195dda8c37ad0df78c9a7fb2ac424cc36d245e9d3e58f960bb538b1ec99e3baf66
MD5 SHA1 SHA512

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\v8_context_snapshot.bin
Size 585KB
SHA256 869f5e88fb5e04840f035fc1c3f688e94499c8514bd053c9979413ebb8de4611
MD5 3f6f227dc46c0d5262cd6ca9bb7703e5
SHA1 c8bc76f93cc6305e70f2041a52acfa6c44e9889b
SHA512 566394fef910b8edeb04c7f5c172ce9b361478275463f7eee4b5611536241431fa7638e47e5ac4b9df7467c98b120869b4e4f87e46628b40dae5685897cd256c
SSDEEP 6144:SLhVh07R65h0Unilcn+TRGphsLj3hyULH8eEe4tU4j8d5q3Qf:SLV09I0U9Luk88ej4id5q3o
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9036\vk_swiftshader.dll
Size 4.3MB
SHA256 4cfd5978ffa3d12a6626181a903b12346d8d1fa6a77fc60054012791b5a14684
MD5 168154970565ca953a65a7efdc30da87
SHA1 a4c6e39af0d1799fc94db050b4ba0821d43d2032
SHA512 ff111f30f6b9464af437635105ae8c40fa923516c165743d732537c86d727a9fad6bee7502789efd44c0a69bea6fa8175eae5cb80a65519019d184445c67faea
SSDEEP 49152:mRtxCyzWuNtr3nQAqKktwjcXBQsHTTZjbryATFeYkScdII2HM2lbpTFk6dwkIIqY:mRGrww1VIiy0SpGOjECFftxg0jm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Discord-1.0.9036-full.nupkg

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Discord-1.0.9036-full.nupkg
Size 90.8MB
SHA256 113f50be0da02f24ad66855e4df614af732f0a180915fe84da8cb16213648029
MD5 a7525aaa0ad5a711be304ba94745d118
SHA1 2c8787a7a94f7662370a564fa57d7748932c79e2
SHA512 cba0b50213ec87767a1b93a9c622bf033902be9c25961a4ffdc1a918658eae300efef14a9475ecf3c49d10c382b09b2836a77739d0b80856a2d769492286aee6
SSDEEP 1572864:IHL3TvHvUDjD73juDoe1x1hoXYJDTLZOGwWibhj0qfFV+YseiNEjml/u6X:avAD73Woe1JozxLb3fFVViNEUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 80B
SHA256 741de6fc0492beaeefc2f4398eb2faefcfaff09d58663296865bbabb63a55576
MD5 a008caf4216520dc0c8f382263d692bb
SHA1 d0531e101559a09b38b481c9750cad02ae2e10f5
SHA512 cce9dba3c4aabc3f89b2360dc9c12797f94934658b973b9ef20ef5dc93df5eb565393b55ed612992dc59f8322ff46c0c27583040468f5582e5431d4a623d8a7f
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 a4711b64695282d32036ee09ab1a67bc55ba8fa98ff50bf3836539edf5861d52
MD5 a8bb43600921caa6c102a8c44fec01bf
SHA1 b3af41370560e023d9fbb3851f1ccc60d9bded8e
SHA512 b4eb8423578e054ebb224d6bbac9ac4abf46ffd88bebceebf54c5cce480d6a54ecc00966d06eefd1172936bc2c39b5b5aeb1a1b766ab7a6959d9a94acd818b2d
SSDEEP 12288:L6CyLEgR0ro/0EhcXAHjRYSN9bUlOr/oJfT9Pu0XejfQ1JRQ3Tzvx+nDIpnUn:cEgRN/th3VelBPu0XUfWJms0pnC
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1252-219-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/1252-290-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/1252-227-0x0000000004F60000-0x0000000004F80000-memory.dmp

Download

memory/1252-220-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Download

memory/2808-207-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Download

memory/2808-9-0x00000000001A0000-0x0000000000316000-memory.dmp

Download

memory/2808-206-0x0000000006070000-0x000000000607E000-memory.dmp

Download

memory/2808-205-0x0000000006090000-0x00000000060C8000-memory.dmp

Download

memory/2808-204-0x0000000005810000-0x0000000005818000-memory.dmp

Download

memory/2808-10-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/2808-11-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Download

memory/2808-312-0x00000000743F0000-0x0000000074BA0000-memory.dmp

Download

memory/2808-313-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Download

memory/2808-314-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

Download