68eeefd2b6980e569d198701c952a8bc7b7643809fa9c6216d2285a34d119719

Analysis

max time kernel
600s
max time network
586s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord.Bot.Client.Setup.3.1.0.exe
Size

92.5MB
MD5

d81f9496d4d6913bc112c12ef30d303a
SHA1

7483e1df9944ee74fc53fe24950fee70f3761dcf
SHA256

68eeefd2b6980e569d198701c952a8bc7b7643809fa9c6216d2285a34d119719
SHA512

521561f4d220d0eac47b2038ceb3d06b6a902b5942f9758fb85dde35f004556391593e0de0d6fb8b51fc6cb7283924a2c1c3adb6e4a1b7d37b7d2ffc9c02a5fd
SSDEEP

1572864:9QjBsKN5d/NKnd7PdYo98s4IF4BCe2pg2zOD6DE8rMyY4xMjBsKN5d/NKDPqsHu9:9QjBZT1NKnd7PdYo9taBwy6D9MR/jBZL

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 9 IoCs

Processes:

Discord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exe

pid	process
4100	Discord Bot Client.exe
5000	Discord Bot Client.exe
2948	Discord Bot Client.exe
2592	Discord Bot Client.exe
3104	Discord Bot Client.exe
1780	Discord Bot Client.exe
3172	Discord Bot Client.exe
2688	Discord Bot Client.exe
4664	Discord Bot Client.exe

Loads dropped DLL 25 IoCs

Processes:

Discord.Bot.Client.Setup.3.1.0.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exe

pid	process
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
4100	Discord Bot Client.exe
5000	Discord Bot Client.exe
5000	Discord Bot Client.exe
5000	Discord Bot Client.exe
5000	Discord Bot Client.exe
2948	Discord Bot Client.exe
2592	Discord Bot Client.exe
3104	Discord Bot Client.exe
1780	Discord Bot Client.exe
1780	Discord Bot Client.exe
1780	Discord Bot Client.exe
1780	Discord Bot Client.exe
3172	Discord Bot Client.exe
2688	Discord Bot Client.exe
4664	Discord Bot Client.exe
4664	Discord Bot Client.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

Processes:

flow	ioc
2	raw.githubusercontent.com
7	discord.com
11	discord.com
13	discord.com
41	raw.githubusercontent.com
46	discord.com
48	discord.com
1	raw.githubusercontent.com

Drops file in Windows directory 4 IoCs

Processes:

UserOOBEBroker.exe

description	ioc	process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings firefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 12 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Discord Bot Client.exeDiscord Bot Client.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Discord Bot Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Discord Bot Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Discord Bot Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	Discord Bot Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Discord Bot Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 5c00000001000000040000000008000019000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Discord Bot Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Discord Bot Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Discord Bot Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Discord Bot Client.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	Discord Bot Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Discord Bot Client.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	Discord Bot Client.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

Discord.Bot.Client.Setup.3.1.0.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exeDiscord Bot Client.exe

pid	process
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2620	Discord.Bot.Client.Setup.3.1.0.exe
2948	Discord Bot Client.exe
2948	Discord Bot Client.exe
2592	Discord Bot Client.exe
2592	Discord Bot Client.exe
3172	Discord Bot Client.exe
3172	Discord Bot Client.exe
2688	Discord Bot Client.exe
2688	Discord Bot Client.exe
4664	Discord Bot Client.exe
4664	Discord Bot Client.exe
4664	Discord Bot Client.exe
4664	Discord Bot Client.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

Discord.Bot.Client.Setup.3.1.0.exefirefox.exe

description	pid	process
Token: SeSecurityPrivilege	2620	Discord.Bot.Client.Setup.3.1.0.exe
Token: SeDebugPrivilege	4452	firefox.exe
Token: SeDebugPrivilege	4452	firefox.exe
Token: SeDebugPrivilege	4452	firefox.exe
Token: SeDebugPrivilege	4452	firefox.exe
Token: SeDebugPrivilege	4452	firefox.exe
Token: SeDebugPrivilege	4452	firefox.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

firefox.exe

pid process

4452 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

4452 firefox.exe

pid	process
4452	firefox.exe

pid	process
4452	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Discord Bot Client.exeDiscord Bot Client.exe

description	pid	process	target process
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 5000	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 2948	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 2948	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 2592	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 4100 wrote to memory of 2592	4100	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe
PID 3104 wrote to memory of 1780	3104	Discord Bot Client.exe	Discord Bot Client.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Discord.Bot.Client.Setup.3.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Discord.Bot.Client.Setup.3.1.0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe
"C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4100

C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe
"C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe" --type=gpu-process --field-trial-handle=1564,13443733929589584915,16551828966467140085,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1580 /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5000

C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe
"C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe" --type=utility --field-trial-handle=1564,13443733929589584915,16551828966467140085,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2168 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2948

C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe
"C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe" --type=renderer --field-trial-handle=1564,13443733929589584915,16551828966467140085,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\discord-bot-client\resources\app.asar" --no-sandbox --no-zygote --context-isolation --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2560 /prefetch:1
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4960

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1316

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:3420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:3136

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:3104

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:3788

C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe
"C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3104

C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe
"C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe" --type=gpu-process --field-trial-handle=1564,18221706781400543411,8514970432735182512,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1580 /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780

C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe
"C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe" --type=utility --field-trial-handle=1564,18221706781400543411,8514970432735182512,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2124 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:3172

C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe
"C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe" --type=renderer --field-trial-handle=1564,18221706781400543411,8514970432735182512,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\discord-bot-client\resources\app.asar" --no-sandbox --no-zygote --context-isolation --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2452 /prefetch:1
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2688

C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe
"C:\Users\Admin\AppData\Local\Programs\discord-bot-client\Discord Bot Client.exe" --type=gpu-process --field-trial-handle=1564,18221706781400543411,8514970432735182512,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAEAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1620 /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4484

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.0.1191883039\1232532395" -parentBuildID 20230214051806 -prefsHandle 1768 -prefMapHandle 1744 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fe22377-919c-4937-823e-d5b532d554a8} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 1848 12f33a07e58 gpu
3⤵
PID:1544

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.1.1951798808\376459830" -parentBuildID 20230214051806 -prefsHandle 2344 -prefMapHandle 2332 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a293a14a-b75b-475d-b305-537fbc0457e6} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 2372 12f26c89f58 socket
3⤵
PID:2268

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.2.1650982498\1949557256" -childID 1 -isForBrowser -prefsHandle 2856 -prefMapHandle 2700 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db8c6593-c628-4a02-aa82-18ac853235c6} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 3016 12f32994258 tab
3⤵
PID:1072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.3.155265330\1180055056" -childID 2 -isForBrowser -prefsHandle 3580 -prefMapHandle 3576 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b54165d-8339-4682-a5d5-c0baafbc3a80} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 3588 12f3a3c7758 tab
3⤵
PID:3160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.4.1848444037\1218943137" -childID 3 -isForBrowser -prefsHandle 5052 -prefMapHandle 4136 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00f6f562-3532-4417-b12f-cc302c2c730e} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 5156 12f3cbc9558 tab
3⤵
PID:3684

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.5.2106146500\1460083666" -childID 4 -isForBrowser -prefsHandle 5380 -prefMapHandle 5376 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21f88b32-b05b-492f-b5c0-79366ff90499} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 5388 12f3cbc9e58 tab
3⤵
PID:4696

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.6.1608362450\892834112" -childID 5 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb361f36-4b5f-4094-8368-ea72f8b4cb5a} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 5276 12f3cc06558 tab
3⤵
PID:3764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.7.761699721\172180770" -childID 6 -isForBrowser -prefsHandle 5968 -prefMapHandle 5972 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd14f918-ec25-4b11-a560-da8cbfa930ff} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 5988 12f3eae4f58 tab
3⤵
PID:676

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.8.873441389\1659540930" -childID 7 -isForBrowser -prefsHandle 9112 -prefMapHandle 10136 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0e5845a-4557-4fb0-b267-03993a09c3b3} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 4900 12f3a53c058 tab
3⤵
PID:5700

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.9.208698714\334427802" -childID 8 -isForBrowser -prefsHandle 3892 -prefMapHandle 3888 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2e26312-5719-4ae5-aa2c-66ffbb70d25f} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 4896 12f3c346b58 tab
3⤵
PID:5180

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.10.586212083\1840165699" -childID 9 -isForBrowser -prefsHandle 8844 -prefMapHandle 9960 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30084cec-8cd3-4fea-b1d3-d671838f8b6a} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 3892 12f3f6f0a58 tab
3⤵
PID:5572

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.11.1842298032\1565136520" -childID 10 -isForBrowser -prefsHandle 3548 -prefMapHandle 9904 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84f7d058-11b2-4a49-aabd-473d632d803f} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 8808 12f3f6f1c58 tab
3⤵
PID:5584

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.12.619817249\602710046" -childID 11 -isForBrowser -prefsHandle 9792 -prefMapHandle 9796 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3acbb7c8-0ee9-4092-b0c6-97d2276a7f0e} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 9784 12f3f6f0458 tab
3⤵
PID:5592

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.13.309610640\287600647" -childID 12 -isForBrowser -prefsHandle 8600 -prefMapHandle 8596 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85a9d3d7-90d7-470b-8951-46769bc9557f} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 9620 12f33f7a858 tab
3⤵
PID:5440

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.14.1776049079\1398604065" -childID 13 -isForBrowser -prefsHandle 9676 -prefMapHandle 8540 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbbf87b1-02b4-4f60-b6ca-a1d64d8dd37e} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 9572 12f3713bb58 tab
3⤵
PID:5508

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.15.638372799\697991007" -childID 14 -isForBrowser -prefsHandle 8460 -prefMapHandle 8456 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {897c22f4-fa05-44b9-9363-3742ec37fc2b} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 8540 12f3ea5e358 tab
3⤵
PID:5380

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.16.1250010554\1879242242" -childID 15 -isForBrowser -prefsHandle 8224 -prefMapHandle 8220 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01158800-8c90-47dc-bbf8-daf8fc5e5621} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 9376 12f3f0a0b58 tab
3⤵
PID:6516

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.17.667705503\930119339" -childID 16 -isForBrowser -prefsHandle 8068 -prefMapHandle 8064 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {340ac5e9-2084-457a-9da7-d6aa31833249} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 8076 12f3f0a0e58 tab
3⤵
PID:6524

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.18.396073079\471122677" -childID 17 -isForBrowser -prefsHandle 9336 -prefMapHandle 9340 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1256 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2d19753-7756-4932-bcc7-5a685b772bf0} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 9324 12f3f0a1758 tab
3⤵
PID:6532

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.19.52224913\1795261425" -parentBuildID 20230214051806 -prefsHandle 9620 -prefMapHandle 9804 -prefsLen 27774 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {daccc11b-9d55-44bf-a627-d1f8c58ddbf4} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 6140 12f26c7fb58 rdd
3⤵
PID:6488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4452.20.1159262767\273181768" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 9168 -prefMapHandle 5296 -prefsLen 27774 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f86fd30-20c1-4999-85d8-a278df35117d} 4452 "\\.\pipe\gecko-crash-server-pipe.4452" 5748 12f32922e58 utility
3⤵
PID:6496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-5-23.610.3104.1.odl

Filesize
706B

MD5
25ba0471a35249d2f5f3b476c2e27ed5

SHA1
3f373f01e98a1466192fc22a4cf07138e379b6e0

SHA256
43a37327474ddde46eb50a406baf67470cb8186820cd00a1a7a5ede9fc8bc288

SHA512
a82695aeb7c7556beefbeb69cdabd3362e4c924f9ffcf8ebc16d1c40d19db0f4fd60934be19de4b5b2c50e9d98b84e6d3f5b804372652bfbfde6d5785d8f8190

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-5-23.610.3420.1.odl

Filesize
706B

MD5
babe4d24d96cac0c7e3989c974860df2

SHA1
d78c716164b0bf437c1f6f1b616546fcf0b364d5

SHA256
85c31781b00d39bb8ee8013e3ffa1bd6d39424f77612adbd5a4ffa2fb1d27186

SHA512
eb051e6211f8b781551006ab7d38e9ed3a794a5f71b3a9efa7dcef6f718272180050bfa5a0f3d6379f86e1552c5e9a38739dd50825e7c82c93782dd626638999

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\activity-stream.discovery_stream.json.tmp

Filesize
24KB

MD5
de9c4369adf67413059707715eb0ee18

SHA1
bccb06d46148b7ed36a22ad0fe623dc902493fa8

SHA256
ecb3b08961621a7b96d1a20e894f7bb04fe09e666eabd3744f2cbaa7d1d59f06

SHA512
df16d43649a554b037288844a135f41e81ad3a59ecac7d1e93b5d1be69f7d26264962289a6b27727dae5c06e6de23091d386e48242c042ed79bc4a9710d833cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\doomed\20455

Filesize
8KB

MD5
5bd48c2f1eb862f93d8ae953defc5328

SHA1
63efad91defdb4811d6e788e73fa799baae21a61

SHA256
cd022e380f8b6247877048584248dc6213f16647de047009400b8678e9144567

SHA512
a7b3286f59bde7a46d17ae3a2b5bb598767d99e840d0ee0b2fb4efe4a1e0b117f6a96ad087fdb0230c479810fd889f0001d1031883446d5d00517ad3b9f9a34c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\doomed\3283

Filesize
74KB

MD5
445b8b1805113dcc8166f60dd1291af6

SHA1
47e4ff1c6b0083cf9e1fa54bd70bdf37e5cebc2e

SHA256
af0544bbe21b8cecea0a8027ea14e78a3c7d3acdbe96de327dac317a9f521127

SHA512
a61b7f547cc29584b02df9365aac89b2adbb4e3b6a0a105d470ee69decd9a8fa08bc8b89cd4a2c9806945fef11a6bc2478e305c56d433c6ce97c97abe8f1021f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\entries\015828F85B25CD94DECE6C3DA3F4450A672DA4B8

Filesize
121KB

MD5
7ea846f3b6295efd74a9a83e454a98ea

SHA1
474f6c3a1769ad56ef0b1711dde608b4d2e18836

SHA256
2e0abc443ac8663aa4e2421f18c66b2a5d40a7a9dc7e6dcf9d10dfa2db2e5d8d

SHA512
3c1a237c76fecc86511c5b820a632ccfb3c1fe2e629685372bb5de564dfb0bf23c3fb7c0fcc63c75d4cea85c7ef00b0f77e234142594daddc265153b4a6fba0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\entries\10CA604F4625EEFBFF8040DD46176E83385ADE05

Filesize
39KB

MD5
e82163096d48a17e01f81ef6b964f543

SHA1
b396e8b50bf2a9857038f04eb0a9493fdc0ad2fc

SHA256
97a18d26dbf2ff93053fb2399db03157c216815de1d26d14b61a43b9d048f276

SHA512
e4d8738277cb8ba51f531656591c457185cffb1c0b1d04d0479b761088eee2a588bc0ed6aff0a12873f9527396509966c4de0d3a7954f970fdbdec8a14b33f28

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\entries\3B6524C7AFC1C72B638079D399411118FD8FF2B1

Filesize
14KB

MD5
360a2773137d7ff7507981ef78ea0c42

SHA1
7befe82f0214bca5dfd621b53ee562b01b98bde9

SHA256
15b6f4f12723e915ecb7513996f2ec89b8522907f07bbd9dd131b69e877aa804

SHA512
37ad1248d9a1d474649cff066ad0f583003f1ad65cf436579db7f4e9398ed8801f95282c46e5cefd7e74d365fb4d169c6b70dbb0ceeb7cf7b425b26ce9ba988c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\entries\677B80A25A006EDCC273545819E7C8B9A97E5201

Filesize
41KB

MD5
b5e4759210a149c6bcec525ca7a738f0

SHA1
39d22df9655c4e8b091e75f97e795aa3fa4c4959

SHA256
7714f06cc1caa9a8802f394cd451553b05050bed17b33d5f7d22acb06d4699f5

SHA512
22e096a051ece4031ce28dedb11713dccee2401f2980f38784c4b84b7bbe9487de2719882ae389b1283f7c2f31cffa2614b3be20ef6195d269d8471502414db8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\entries\8C3F80BF75488896F913E46A179ADA64145069AD

Filesize
1.8MB

MD5
48c5362cddca805f3e299b66d318e9f4

SHA1
708e81b71993a705fb83a8e1faf5e737fa41d498

SHA256
86fb119786e4121529ed0c8564da55ddfe796b136b11d497c388d517d8420881

SHA512
c10f06660d234f71d67419afa3a763795325c73b00c2ee94f6d445af144e3dbc2186cd64cd7c51563ac9d59091cbbd0e05f716329b4348ba6288459f75261e5b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\entries\C1D72FE360881D28C4A733E5FCDC36DD62AAF9C6

Filesize
256KB

MD5
2e4dabdf85e93ec884f273a79bcf600f

SHA1
f5b436a365a3b339c130ad24a3d3eaccc4d76b46

SHA256
d71c825be6773fab5cabc76984bd1ddd2a5e201802469e18708c2723be0a2e47

SHA512
fbd1ce9d9aa8e80287486630eda3be57037d19e13c9a53f407f2a4b30a5c12631e9986b2b858d27dd6913b56fca01af4545821a7070045ed587cbef499cda3a1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649

Filesize
13KB

MD5
6ba9b97653d297b1e50a966dad2f21ff

SHA1
0656ab0a0b0dc712631f02c9362ba81a0dcb246c

SHA256
e1f1fd875460a3f0fe335f555037929177f7f569733422ba768accf4e3e570c7

SHA512
60b843a854a891538f58c90c5ec3a1f1d8388ce9e4509f7f182c5e5a228d105b6874805058cabcab71020beef8057205799d33c2396bebbf4f2c54e129befbf4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json

Filesize
67KB

MD5
6c651609d367b10d1b25ef4c5f2b3318

SHA1
0abcc756ea415abda969cd1e854e7e8ebeb6f2d4

SHA256
960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9

SHA512
3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json

Filesize
44KB

MD5
39b73a66581c5a481a64f4dedf5b4f5c

SHA1
90e4a0883bb3f050dba2fee218450390d46f35e2

SHA256
022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17

SHA512
cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json

Filesize
33KB

MD5
0ed0473b23b5a9e7d1116e8d4d5ca567

SHA1
4eb5e948ac28453c4b90607e223f9e7d901301c4

SHA256
eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b

SHA512
464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json

Filesize
33KB

MD5
c82700fcfcd9b5117176362d25f3e6f6

SHA1
a7ad40b40c7e8e5e11878f4702952a4014c5d22a

SHA256
c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780

SHA512
d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json

Filesize
67KB

MD5
df96946198f092c029fd6880e5e6c6ec

SHA1
9aee90b66b8f9656063f9476ff7b87d2d267dcda

SHA256
df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996

SHA512
43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json

Filesize
45KB

MD5
a92a0fffc831e6c20431b070a7d16d5a

SHA1
da5bbe65f10e5385cbe09db3630ae636413b4e39

SHA256
8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c

SHA512
31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json

Filesize
45KB

MD5
6ccd943214682ac8c4ec08b7ec6dbcbd

SHA1
18417647f7c76581d79b537a70bf64f614f60fa2

SHA256
ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b

SHA512
e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_finance.json

Filesize
33KB

MD5
e95c2d2fc654b87e77b0a8a37aaa7fcf

SHA1
b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc

SHA256
384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e

SHA512
9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json

Filesize
67KB

MD5
70ba02dedd216430894d29940fc627c2

SHA1
f0c9aa816c6b0e171525a984fd844d3a8cabd505

SHA256
905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34

SHA512
3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_games.json

Filesize
44KB

MD5
4182a69a05463f9c388527a7db4201de

SHA1
5a0044aed787086c0b79ff0f51368d78c36f76bc

SHA256
35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85

SHA512
40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_health.json

Filesize
33KB

MD5
11711337d2acc6c6a10e2fb79ac90187

SHA1
5583047c473c8045324519a4a432d06643de055d

SHA256
150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565

SHA512
c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json

Filesize
67KB

MD5
bb45971231bd3501aba1cd07715e4c95

SHA1
ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a

SHA256
47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d

SHA512
74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json

Filesize
33KB

MD5
250acc54f92176775d6bdd8412432d9f

SHA1
a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65

SHA256
19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54

SHA512
a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json

Filesize
67KB

MD5
36689de6804ca5af92224681ee9ea137

SHA1
729d590068e9c891939fc17921930630cd4938dd

SHA256
e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52

SHA512
1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json

Filesize
33KB

MD5
2d69892acde24ad6383082243efa3d37

SHA1
d8edc1c15739e34232012bb255872991edb72bc7

SHA256
29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a

SHA512
da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_law_and_government.json

Filesize
68KB

MD5
80c49b0f2d195f702e5707ba632ae188

SHA1
e65161da245318d1f6fdc001e8b97b4fd0bc50e7

SHA256
257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63

SHA512
972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_online_communities.json

Filesize
67KB

MD5
37a74ab20e8447abd6ca918b6b39bb04

SHA1
b50986e6bb542f5eca8b805328be51eaa77e6c39

SHA256
11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f

SHA512
49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_people_and_society.json

Filesize
45KB

MD5
b1bd26cf5575ebb7ca511a05ea13fbd2

SHA1
e83d7f64b2884ea73357b4a15d25902517e51da8

SHA256
4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0

SHA512
edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json

Filesize
44KB

MD5
5b26aca80818dd92509f6a9013c4c662

SHA1
31e322209ba7cc1abd55bbb72a3c15bc2e4a895f

SHA256
dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671

SHA512
29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_real_estate.json

Filesize
67KB

MD5
9899942e9cd28bcb9bf5074800eae2d0

SHA1
15e5071e5ed58001011652befc224aed06ee068f

SHA256
efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a

SHA512
9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_reference.json

Filesize
56KB

MD5
567eaa19be0963b28b000826e8dd6c77

SHA1
7e4524c36113bbbafee34e38367b919964649583

SHA256
3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49

SHA512
6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_science.json

Filesize
56KB

MD5
7a8fd079bb1aeb4710a285ec909c62b9

SHA1
8429335e5866c7c21d752a11f57f76399e5634b6

SHA256
9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32

SHA512
8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_shopping.json

Filesize
67KB

MD5
97d4a0fd003e123df601b5fd205e97f8

SHA1
a802a515d04442b6bde60614e3d515d2983d4c00

SHA256
bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6

SHA512
111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_sports.json

Filesize
56KB

MD5
ce4e75385300f9c03fdd52420e0f822f

SHA1
85c34648c253e4c88161d09dd1e25439b763628c

SHA256
44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14

SHA512
d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\nb_model_build_attachment_travel.json

Filesize
67KB

MD5
48139e5ba1c595568f59fe880d6e4e83

SHA1
5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78

SHA256
4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa

SHA512
57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3qt190sk.default-release\personality-provider\recipe_attachment.json

Filesize
1KB

MD5
be3d0f91b7957bbbf8a20859fd32d417

SHA1
fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10

SHA256
fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7

SHA512
8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\D3DCompiler_47.dll

Filesize
4.3MB

MD5
fea40e5b591127ae3b065389d058a445

SHA1
621fa52fb488271c25c10c646d67e7ce5f42d4f8

SHA256
4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345

SHA512
d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\chrome_100_percent.pak

Filesize
175KB

MD5
7c4728b2d58afdd97c4549c96b9561cc

SHA1
1e0d251eedd67e7021fc764b9188184617465c54

SHA256
419cfcc6dc5f38b2e0c970ebd4fad1ef55054579d5c0db2521d7ae494996aac3

SHA512
82d0931e4d1cf38f88050980f518cdacdc981c382771b1732bfbe69f601074a0e7378e27a7470c7dea4e287cb1617a5c038052908ed85134abcd5b6591b4e7df

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\chrome_200_percent.pak

Filesize
312KB

MD5
6af049ad6fd11ee90ad9db31c4e02082

SHA1
5d2f9a59a74dc584b5dd78aeb6de583e969e3eb7

SHA256
edecf8e1ac353bfdae534e42507e5a59973cb4cab76fbb1ff1a470363e725bc4

SHA512
c7fa6e1a57861e62b9b4d615a988c98d13cde8abc23eaed7c36c2ecb86409da4b65b1f579ca2f307e90eb4d08d14b07f7f41ccb8d8c165d6de67c09c16009715

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\ffmpeg.dll

Filesize
2.6MB

MD5
2a446587405297638961971e31a5c9a7

SHA1
01f322b9753ac1e45b3b96ea848e6080e6657291

SHA256
98adb4e59043d1e7eae99e5535042380be0f6f7eaaf00e41abed8563975834f8

SHA512
ae0c0eac34ab6aa383fbfddbfa4acfc89e783410f77b48836b98df5e04fcc1cad4a6c8b965c420db5c85f9098b8645c03ae17eb63a91b8f304ae958803c625b8

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\icudtl.dat

Filesize
10.0MB

MD5
3f019441588332ac8b79a3a3901a5449

SHA1
c8930e95b78deef5b7730102acd39f03965d479a

SHA256
594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57

SHA512
ee083ae5e93e70d5bbebe36ec482aa75c47d908df487a43db2b55ddd6b55c291606649175cf7907d6ab64fc81ead7275ec56e3193b631f8f78b10d2c775fd1a9

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\libegl.dll

Filesize
371KB

MD5
20af285de696b1bfc0593be4c3461b1f

SHA1
78e00a44236c50dbd158a0970c3caabd4cae1fa0

SHA256
8d20d1ff33cdd11227b1ef01efd8207b4d315171be1dc7647c9fe2b777be9e1d

SHA512
5865b433b0073eb6139c689b3153ddd692eb5a23204d99f19ed92cc1d1fea7e24cdea636ef388271cbc0b8b9ac81614bc5cf1d0c2173975684f345cbac152a4f

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\libglesv2.dll

Filesize
7.5MB

MD5
b51426325e06145dbdc2337039c2a140

SHA1
e16aefd9c2d6af72e63246472a6b1507c0e41b8f

SHA256
9e2140b4e219b64e4cdab3645d5d51306d070ba60c47c88303cd76b990042274

SHA512
2991a374fc7a9ed243a25e1e5a97e729d456042bd24ae2522b6ef366eb3bdd44171beb8c3e3d8238cd531ed9a50558735c63094c3cdb4394ac407d03006a4d99

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\locales\en-US.pak

Filesize
79KB

MD5
98c8cfc3cb98ab34e06d4323b8bcb043

SHA1
2c0bda072161530b710fa0a1dfc3c23926184afe

SHA256
35adc5aeeebfe440e295b88d2a4089360ada33c353843b1f5438f4118501878b

SHA512
25edeca13b4a29f63bdc4f135eda1b1b8c72f3a58315f57895950bdc15f56b2af1aca42affe397716f5965437ece836f683265a33ec919b8b26056634612ed3c

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\resources.pak

Filesize
4.6MB

MD5
d9022282a7fbf3aa354559ab6a9c7926

SHA1
ff1f2b77d80848bc1a51e48c21a033eb57d8776c

SHA256
ddc85d749b19cbabae11a0b8f7114daf75900179a2147280dd0f9f8faee7d65c

SHA512
6b9ab157cf8e10d8a79ea2ad4e247210fe2a7fd75dab086eb55951d4e028af3060e1f42175be936c6b093abc2c3071c0fd1c45afee3c567a79e1b722fe5f5d97

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\resources\app.asar

Filesize
211KB

MD5
036507748c199b333f7e384cbe1624c5

SHA1
265e4a1f21b795f2daaac7396e99160ccee71186

SHA256
2dcfc2def35de0023d2d7e4403a27d139752f91ed5038554d9a745d231aa0195

SHA512
30685e9113caaeb33a3043d3c8be1fbf4af0c4c2caaacc5e7a8d1db1c28ff55c1c10b9078026d9ee930c473a0d5bc0ea41f7d4eeb547399aa799d82bbcf3db6b

Download Submit
C:\Users\Admin\AppData\Local\Programs\discord-bot-client\v8_context_snapshot.bin

Filesize
166KB

MD5
d9b62a61b9242c2d29da71d58421f08c

SHA1
62eb4411599dba13fe617a860096fe21a8141d0f

SHA256
9010758e1b4453957e561dfe6dd1c891400d7a0fb78097e8e67d9a8076644588

SHA512
1d0bd25bd3c5cb55e80592bc2a15ec94c31263fc518533c8f8d6434e9896f11aabeda2a8fa08601829fcb395ea5c69629ce2ded43d1f8106d982e1d21946832a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5082.tmp\SpiderBanner.dll

Filesize
9KB

MD5
17309e33b596ba3a5693b4d3e85cf8d7

SHA1
7d361836cf53df42021c7f2b148aec9458818c01

SHA256
996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

SHA512
1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5082.tmp\StdUtils.dll

Filesize
100KB

MD5
c6a6e03f77c313b267498515488c5740

SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15

SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5082.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5082.tmp\WinShell.dll

Filesize
3KB

MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56

SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c

SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5082.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5082.tmp\nsis7z.dll

Filesize
424KB

MD5
80e44ce4895304c6a3a831310fbf8cd0

SHA1
36bd49ae21c460be5753a904b4501f1abca53508

SHA256
b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

SHA512
c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\1fbaf638-45bb-47c9-aea6-69cd6bcdb57d.tmp

Filesize
334B

MD5
749cbd1afa835647b233be45dde5bfb3

SHA1
fc892fc8f70dcdb08a9fb0a544e991663d721719

SHA256
1e558fd915c50fbe9f8bac384ce72d2155912855a1d87dcff00f22c7a964c59b

SHA512
243580442586e7b4f49f4d7b3e95cae27e57752d405dd18f0c76df54283407b23f30884f4fd545d537fca8227bff1e1af43cc809d199cc7ee2fb12fb031ad4d7

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\36ce8e86-34f9-49db-9ef6-089a6ca92893.tmp

Filesize
212B

MD5
5767b981282906d628e9a696cae8098e

SHA1
8de20cce4a0a31e718b97e6d278bed8a7df15b8f

SHA256
c62b9f7b2b2591089323e3777c1856c5a2844bce5e857c62a3a85f7421e87393

SHA512
6edc07885ee1ce6c4899b0b5a0268af22c0c7e9d020ee74395f00f976454dae0c63b74c81efdaf9372a1fcfc1f89e9de6ad211c2a88a0e18ff7d0c75ea5f6081

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\4dbbefdf-d3d3-4d8e-8705-925b3e1ab0dd.tmp

Filesize
212B

MD5
0cee3309e267c4484330aba078fc4a29

SHA1
5201998e0ee9b02453de27752e6cc2e6cefee92e

SHA256
6cf410113f83b20f5861726b310b40823405c98c1a4ea86c487021f3e80ec4c4

SHA512
82afbc8a20f927a68f40edcdd079baf4e1befd25a88bda72db746cf0ce23fc4ebb058fc4eb35caa31f23b8e722021ca8658ed7f7073262a6c7d0789ce45838ee

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Cache\data_0

Filesize
44KB

MD5
c5ef754925bda62699af737c32c74a44

SHA1
05776a78eff54883d637e0761a364ffe6e9eb9dd

SHA256
4c8148f18fd4926bdf1682cc435da8f4006f3110edb801b68fbc77e4fb1eda65

SHA512
f99281dcab14ad3b3c7d6ceaeefde3ee5f58c9dc08e959f0db76cd55d7aebb08d9c37e0e7ee920604f9e3fca8a2f9642593239391334cbaf8de61278e27126ef

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Cache\data_1

Filesize
264KB

MD5
cd57bc5df1bd07338c0c1720b8f29dc6

SHA1
04f0a39e1791f2b3ac5f6be0a1afb3af38ddc156

SHA256
4cad26f987a23c327eb0db035081d12f87890e4fb63daa7a4c6efaf718b25dcf

SHA512
348af1f31ca3df63b7a8704667acaf55ad59f64443aa4d227e5fe222c348e7814e5e01b21d1508dced2e8029343f212883ebc48511bec38143f32315763b802b

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Cache\data_2

Filesize
1.0MB

MD5
81d6d8d97bdeb3365b82d91d3ac85b34

SHA1
9d9f4499c9479b69aeb6e06c5c3c0cb6bd3a2a14

SHA256
6d4f845ace76259f6d0502a1cf14328d0917071a23eea4563645864bf1ce73e3

SHA512
7f610040bf20094a8c14f363e3a43a4599cd0ab128bc1fb079dc879646808d778683ecbae32dfd24947e667dca6798cbf841b3efd61e6cc1dd1c428445c0e7c2

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Cache\index

Filesize
256KB

MD5
199c2e064ae03dec31757f23a55680c9

SHA1
805fc15b4c8c6b203c8f784fefdb6bf117a56831

SHA256
d24ddbd0f459aed56b6f06bd74cd1b3bf97775839e33b75d6437f0e7d7f99ca5

SHA512
545c9911bdc8c2a756d8c1fc23dc3d2330e21eac4dd0cecbe427c167860d16eacf0518856daed5c09eae97568f9e40f9f9e94c5fb9161b0cac8802cbba3b3817

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Code Cache\js\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
7b0bfc632351506b4ff510b614e9a5cc

SHA1
6bd7b92177ae63374a9186e12d0f7c1f7703119f

SHA256
3714645b2a32f3e10085966118ce2c51c1567cec171f8fe78560774c2d1d6350

SHA512
08b79faa4a08d153a576c1b763efeca0e2512d6ffed054b4b86ae78b2d2280cc5932bbb5466a049eca785f84fee7689c3f89f5ea3592d81b74aa40a0d1fd5f6e

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
aba4209707d4be159c6c6a9a7a9b255b

SHA1
97ca407f09e41d13b08525dc3ff27299425f5a39

SHA256
7e3c20f0707536cbc7c6ae206824410fe5fb45a856b45e897fe96c942509b742

SHA512
44b0f72c99a0e46bddb472e96c0fad4a49e0e007d6c3553aa8bec319d64e36d5d6eadc0c9b33f14caa11515076eeca4e13b66323e9d91e89292f80b8093255fd

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Cookies

Filesize
20KB

MD5
fa6c4206c9a14d596857f4ab3a5af869

SHA1
4ef5200d81ecc2ae2fdf2c44a0b0f73306ef2ea6

SHA256
c870dccb0d53524e0bf7da5b7ecb0157a7a2c90af1621c8c23f939f393b17e59

SHA512
e50d153501b766aaf9c2250ef9f3ec7493802bb435be6a3d4e57be17c9eb03e21a21eeb3ab40cf5f817f6e5e8ec0a6e1b9ac6976688656138e22abd8daaf0abe

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Dictionaries\en-US-9-0.bdic

Filesize
441KB

MD5
a78ad14e77147e7de3647e61964c0335

SHA1
cecc3dd41f4cea0192b24300c71e1911bd4fce45

SHA256
0d6803758ff8f87081fafd62e90f0950dfb2dd7991e9607fe76a8f92d0e893fa

SHA512
dde24d5ad50d68fc91e9e325d31e66ef8f624b6bb3a07d14ffed1104d3ab5f4ef1d7969a5cde0dfbb19cb31c506f7de97af67c2f244f7e7e8e10648ea8321101

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\GPUCache\data_1

Filesize
264KB

MD5
d6cf6fe301c56d66259279047691b1f9

SHA1
bff2be3b6757412bcdfb1843b1bca99e7c3a120d

SHA256
b92c453e32ebc35ae10ac17d05f9361572bc2bd48b7b125bb6a94d232fa6a45d

SHA512
eed69159d27111af6c4d06df39167442580ade05894fb17545e7735d71a13e6e3df1a81af0c7dd74024a0d38edf83f655f8a3a8c5e3ab7f98b3cf3a6264a1dee

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\GPUCache\index

Filesize
256KB

MD5
dc856d28b393aefe2a6e2e99614992c7

SHA1
76408f29f358c0b4131bb63a280005384accb4aa

SHA256
2eab8ea0e2bdfa5714f827fccdf6ab0e5b89fc4f78b9831336d8f69ac5c63b59

SHA512
da8414c7b795fecfb5f2045440ad6d536a164c12d0812130d7a9d2a342dc49da7536a2c8da39f488f7c1812281a8aa0215ea70420bddf4aab081ef8f7a1335fc

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Local Storage\leveldb\LOG

Filesize
133B

MD5
47dbbcc1604c7073f5ae44672eaf4e82

SHA1
499cc09e6695c22a7a6d34d987e598f0bf214104

SHA256
9f3df7f984a419d717a376f65fdcf14f4c5432dd67bdf0bee4319799f132635a

SHA512
0e2223be2173db2f3b1a794ab4f30c37c11bf4c9cdda6b6b9369b77fbc13ab94ef9401b79e41f379b75180b6dc52aa1a635bb7d5fb6a57d33a956902a9676b6c

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Network Persistent State~RFe58825a.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Preferences

Filesize
57B

MD5
58127c59cb9e1da127904c341d15372b

SHA1
62445484661d8036ce9788baeaba31d204e9a5fc

SHA256
be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de

SHA512
8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Discord Bot Client\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
4f913621c8a0b0da9832c9b38b000c7b

SHA1
e9e81c3beb7f39f619c235041ea3cb7e2bf787a5

SHA256
1655a5945ec9a2caaeef163db523d849a7ea083af8826d7da2e6789f86a6ba0b

SHA512
0256d218b7ef9d013631afd259874ef3783896f5ab7b464304b385ac0bb736aa40a3b237a56680df4b5f1bde6131cd442323011c5e4c082ddde2b0a4bd9d2b7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\bookmarkbackups\bookmarks-2024-05-23_11_suW3jlX8MorawCiDOxmilg==.jsonlz4

Filesize
998B

MD5
e29ab902578c52589f843b13791f1458

SHA1
114afd8e23882730ce3d2144265214c5f326b150

SHA256
bddd419c85bbb2bb58a3fd5a44862e253485449781c893fd27b8a25b7f23f497

SHA512
8bffb38a5c861144303e32a76ff2869bd5872b39ca6dd52c7d0c4ec2e34951f32b91d7cd68843ff7c8ff203569887eb5214b4af35a2038f9c8dfeb7c7c2b7a8c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\broadcast-listeners.json

Filesize
216B

MD5
3515def4473f842cbb46fe0ff9a31d2b

SHA1
c80b1ac0af73fd9cad8383ead24a7e220e176bbd

SHA256
2f3db5618873486f62d801e223352449738da479a76d32bf35270c955600c29b

SHA512
106adac6e82a85357d4b83e66e36308fa2cc07e0433e678bb43e85e5f18915aec4d10683ce744621f4c0c32d4f20ec4f126df3f1a1caa94eec986d27e0adea70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs-1.js

Filesize
6KB

MD5
31aa41a146b3ad009657871c23d32884

SHA1
7e5001066126a5fddb65e053f86c24ad40793602

SHA256
a573004126b025d52a0d72e54e40b088a89c3b0232886238c27c28a37fd81920

SHA512
3d97e81f6c38379d1704d448458e01d7ace20d5f30a08780f9e687a8a0acb5f18e9fc2b77ea34de36ce6c9ee4b4130bef5ab928c9bdea1529ef7db120c5526b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs-1.js

Filesize
9KB

MD5
aebb01ba52bca1ef62423dead5b407a6

SHA1
d6dc7eda54bc71a72c0c073734653b1847a95211

SHA256
60b4c409d0b8a0680d8743fc1bee884b6a75b06877d44363d1fa915a2c6d8700

SHA512
4d0b8a7c83250cf43f6df20ba2739eba0f132219fc6563c80ee5e4202fbf6f062dc663e415ebce3f90556ab92ab64b72fb58707418b5df928b6164fbc184b6c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs-1.js

Filesize
11KB

MD5
745d698a81ca47607f683a4de90b0096

SHA1
98f3a25567ea07c2bf713c9a00335d8d2499c386

SHA256
6b82fc1c0aa0f991746cbbba2d36f51c9a0d0831b2de27d4875ede6b87b8b651

SHA512
fd7411ae9f574c7529143bae67b65c7259ce47cd2604c37311c42683497186e060c2a9f950034c47969d3aa472d2ead8404922ed02f5c68a5a81022d333402a6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs-1.js

Filesize
7KB

MD5
e78929258a0954d655e754f2b9471940

SHA1
8b9172da62df478c907ef2232355749bab80ae7c

SHA256
fa0788c3660c660200c3e3f10e7a32adf01bc3744e1c0be2cc96aaa80ae050ef

SHA512
4bb24cab3566867c073679ebec2c04e512bb02010af0dc08a5228a8bd2b48d1d79fe50fbabf143d0fb1b2648638b68dd274fdb36d9eca1a811d291c6715c4eb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\prefs-1.js

Filesize
10KB

MD5
aef8732a55aa6f9c9d44dcccf4db41d0

SHA1
080cf8dba49852d0630220a28417a4cafb9eeba8

SHA256
bc12cc64d20c096d47fb36a5276069ae585b81325e2adf0fb720b792a5ef1144

SHA512
05b0ffcb27a273f4e1c76fa5d9f79ce5fa0c42a09612c80a8221cfddf5630ffe5e47f409d1d71fccfd8f7ef31647d15635659c84f271629d3b0fc75b67b68707

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
12394db66c7af40f6d33bb84f404024e

SHA1
aad4a1e0692fbab13a099142195ac57c37faee6b

SHA256
fbd075ebae65ec28056caa43eca05626d5ea03242a4b760126683817ca8b9c74

SHA512
c1db414578829953883395f2eb6aea75d22a8b3fc91d3a84d2a190758dd2bd95b09d58e09a62380ce78908cc68784e425048508f3c05186579709cb074ae4202

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
6e5f300b243c3157debe50302887966f

SHA1
e14f7f1aa02d17095aabd4dc2c6c6358807a2148

SHA256
8b2cf9d6ca301e672142664ae9e71c0956aad60ae4f649ad0cc4cb10a2ee0f41

SHA512
68f0309fcfcd0994411ac4b7fff328f125fd9678f4b81d0d3e3a7b3f33f07a5563274e24442a4bbd721f693c27dd9640b4444a213621fcde2ae14a7f6579d538

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
9ee47b371e3603e42c16bc80366249b9

SHA1
3370107e3c8d0dab0d439db3fdb38b498cb76ab1

SHA256
74c9beea7f87f9d4e2cf12a50a2931750efbd0d11b1073e3aa9f5d5fb31ea27e

SHA512
34481def08a9913ad9075f8c1f3ce9e9af40d37dcd703046ed99ff7fc17647edfd5b16f6d6a249ca8e58d7155213f61b849b340c8a41ca5b8ce9759a3e358035

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qt190sk.default-release\targeting.snapshot.json

Filesize
4KB

MD5
cb2b46906e612f4b9c8d052e450c8139

SHA1
f11e130531b57212bfc7685aca3f993acc3af8cd

SHA256
4202745a86199e9dde1d4be8f5b38a51e19cae52ba2b54917e8ac2cf87cb11dd

SHA512
27bb23836547a53aed168c5799c01f12ec7be0c64d58955052bc6a7707fd9a632758230d03346ffae292c0a038aab70f0c384993aea48640189c26fb56deca2c

Download Submit
memory/1780-377-0x000001E2B44B0000-0x000001E2B455E000-memory.dmp

Filesize
696KB

Download
memory/5000-212-0x00007FFB292A0000-0x00007FFB292A1000-memory.dmp

Filesize
4KB

Download
memory/5000-267-0x00000156C1610000-0x00000156C16BE000-memory.dmp

Filesize
696KB

Download