a55be1455b761ae89f109fa457b20b6be8d8ff56586b0e7e78789a7d996316f3

Analysis

max time kernel
1045s
max time network
959s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ShadowNet.exe
Size 14.3MB
Sample240608-3ppmqsba24
SHA256 a55be1455b761ae89f109fa457b20b6be8d8ff56586b0e7e78789a7d996316f3
MD5 c471e640f97a3001ad296a8e7672aeb0
SHA1 bf179605d5af17c889100ae2709e4975e3ab6d37
SHA512 b3af4c368ca049a8b68187b784d99f8d7d90bd10fa17b8286807640effa936fabcc5c9be5891e2584f263f9bdc6b09833a4fef7d29892f9cfbde6c0e5a39c178
SSDEEP 393216:TAc0efjFG821+TtIiF90VQM2NfPgaLP7KC:TdfjFG821QtIN72NfPDK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Discord.exe

Executes dropped EXE 15 IoCs

pid	Process
1532	Update.exe
3600	Update.exe
2596	Update.exe
4032	Update.exe
3004	Update.exe
1876	Update.exe
5980	Discord.exe
3680	Discord.exe
5168	Update.exe
5308	Discord.exe
5324	Discord.exe
1964	Update.exe
5232	Update.exe
4068	Update.exe
388	Update.exe

Loads dropped DLL 64 IoCs

pid	Process
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5112	ShadowNet.exe
5980	Discord.exe
3680	Discord.exe
5308	Discord.exe
5324	Discord.exe
5308	Discord.exe
5308	Discord.exe
5308	Discord.exe
5308	Discord.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe
3460	ShadowNet.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

flow	ioc
269	discord.com
272	discord.com
15	discord.com
20	discord.com
147	discord.com
227	discord.com
268	discord.com
11	discord.com
16	discord.com
149	discord.com
267	discord.com
10	discord.com
228	discord.com
270	discord.com
271	discord.com
13	discord.com
148	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9148\\Discord.exe\" --url -- \"%1\""	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	DiscordSetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{9C5E0391-D059-46D4-9877-5B76A53928DB}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord\shell	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9148\\Discord.exe\",-1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Discord	reg.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
5708	reg.exe
5764	reg.exe
5808	reg.exe
5860	reg.exe
5952	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5580	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5980	Discord.exe
5980	Discord.exe
5980	Discord.exe
5980	Discord.exe
5980	Discord.exe
5980	Discord.exe
5980	Discord.exe
5980	Discord.exe
5980	Discord.exe
5980	Discord.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5980	Discord.exe
Token: SeCreatePagefilePrivilege	5980	Discord.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2596	Update.exe
1532	Update.exe
1876	Update.exe
3600	Update.exe
4032	Update.exe
3004	Update.exe
1964	Update.exe
5232	Update.exe
4068	Update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 5112	4144	ShadowNet.exe	90
PID 4144 wrote to memory of 5112	4144	ShadowNet.exe	90
PID 1964 wrote to memory of 1532	1964	DiscordSetup.exe	135
PID 1964 wrote to memory of 1532	1964	DiscordSetup.exe	135
PID 1964 wrote to memory of 1532	1964	DiscordSetup.exe	135
PID 4760 wrote to memory of 3600	4760	DiscordSetup.exe	137
PID 4760 wrote to memory of 3600	4760	DiscordSetup.exe	137
PID 4760 wrote to memory of 3600	4760	DiscordSetup.exe	137
PID 3492 wrote to memory of 2596	3492	DiscordSetup.exe	139
PID 3492 wrote to memory of 2596	3492	DiscordSetup.exe	139
PID 3492 wrote to memory of 2596	3492	DiscordSetup.exe	139
PID 5016 wrote to memory of 4032	5016	DiscordSetup.exe	142
PID 5016 wrote to memory of 4032	5016	DiscordSetup.exe	142
PID 5016 wrote to memory of 4032	5016	DiscordSetup.exe	142
PID 3896 wrote to memory of 3004	3896	DiscordSetup.exe	143
PID 3896 wrote to memory of 3004	3896	DiscordSetup.exe	143
PID 3896 wrote to memory of 3004	3896	DiscordSetup.exe	143
PID 1248 wrote to memory of 1876	1248	DiscordSetup.exe	144
PID 1248 wrote to memory of 1876	1248	DiscordSetup.exe	144
PID 1248 wrote to memory of 1876	1248	DiscordSetup.exe	144
PID 4032 wrote to memory of 5980	4032	Update.exe	145
PID 4032 wrote to memory of 5980	4032	Update.exe	145
PID 5980 wrote to memory of 3680	5980	Discord.exe	148
PID 5980 wrote to memory of 3680	5980	Discord.exe	148
PID 5980 wrote to memory of 5168	5980	Discord.exe	149
PID 5980 wrote to memory of 5168	5980	Discord.exe	149
PID 5980 wrote to memory of 5168	5980	Discord.exe	149
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5308	5980	Discord.exe	150
PID 5980 wrote to memory of 5324	5980	Discord.exe	151
PID 5980 wrote to memory of 5324	5980	Discord.exe	151
PID 5980 wrote to memory of 5708	5980	Discord.exe	152
PID 5980 wrote to memory of 5708	5980	Discord.exe	152
PID 5980 wrote to memory of 5764	5980	Discord.exe	154
PID 5980 wrote to memory of 5764	5980	Discord.exe	154
PID 5980 wrote to memory of 5808	5980	Discord.exe	156

C:\Users\Admin\AppData\Local\Temp\ShadowNet.exe
"C:\Users\Admin\AppData\Local\Temp\ShadowNet.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\ShadowNet.exe
  "C:\Users\Admin\AppData\Local\Temp\ShadowNet.exe"
  2⤵
  - Loads dropped DLL
  PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4312,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=1324 /prefetch:8
1⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=3384,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
1⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4056,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
1⤵
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5304,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
1⤵
PID:376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5464,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
1⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5468,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
1⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5500,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
1⤵
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=5504,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
1⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=5236,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=6352,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
1⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5408,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
1⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=5376,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
1⤵
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6632,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
1⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=6664,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
1⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6860,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
1⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6048,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
1⤵
- Modifies registry class
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=6660,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
1⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=6944,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
1⤵
PID:524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=7020,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
1⤵
PID:3364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=7456,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
1⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --field-trial-handle=7428,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:8
1⤵
PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --field-trial-handle=6720,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
1⤵
PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=7968,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:8
1⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7376,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:8
1⤵
PID:924

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:1532

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\ProgramData\Admin\SquirrelTemp\Update.exe
  "C:\ProgramData\Admin\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:3600

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:1876

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:2596

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --squirrel-install 1.0.9148
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9148 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x4ec,0x4f0,0x4f4,0x4e0,0x4f8,0x7ff65f9e3108,0x7ff65f9e3114,0x7ff65f9e3120
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3680
  - - C:\Users\Admin\AppData\Local\Discord\Update.exe
      C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
      4⤵
      Executes dropped EXE
      PID:5168
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2112 --field-trial-handle=2116,i,16981163703640856314,16497328434495730757,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5308
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --mojo-platform-channel-handle=2252 --field-trial-handle=2116,i,16981163703640856314,16497328434495730757,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5324
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:5708
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5764
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5808
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe\",-1" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5860
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe\" --url -- \"%1\"" /f
      4⤵
      Modifies registry class
      Modifies registry key
      PID:5952

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:3004
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\SquirrelTemp\SquirrelSetup.log
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5580

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
PID:5020
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:5232

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
PID:1248
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:1964

C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
1⤵
PID:5940
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:4068

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
1⤵
- Executes dropped EXE
PID:388

C:\Users\Admin\AppData\Local\Temp\ShadowNet.exe
"C:\Users\Admin\AppData\Local\Temp\ShadowNet.exe"
1⤵
PID:1964
- C:\Users\Admin\AppData\Local\Temp\ShadowNet.exe
  "C:\Users\Admin\AppData\Local\Temp\ShadowNet.exe"
  2⤵
  - Loads dropped DLL
  PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=7372,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:8
1⤵
PID:5768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Discord.exe.sig

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe.sig
Size 1KB
SHA256 fb2c0256dfe8e807451b4fb021b6899b633d2fc0ff74258e2af03e03f020425a
MD5 1d5bfd3f81d644e57d158d55f92ec5a8
SHA1 8ce160cf80e05a6dce54d157f45656dfce0f0fce
SHA512 5b1a56e078e4bd67ce1d6397a3574d2b527eecae0e2f26674ed62b9309283ea819031bdc66937a6843ef8874d3b00fceb039a878565a6507e9c3952ad7d1468c
MD5 SHA1 SHA512

Submit Download

app.ico

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\app.ico
Size 278KB
SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
MD5 084f9bc0136f779f82bea88b5c38a358
SHA1 64f210b7888e5474c3aabcb602d895d58929b451
SHA512 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb
SSDEEP 192:uz/QWppKvrIXANuBox26FIeSyyEh9Y1kM12wngfi3TjOueN3/R/l:E/QWppKvrIXANuBc6gq3TjOuevl
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\chrome_100_percent.pak
Size 163KB
SHA256 b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
MD5 4fc6564b727baa5fecf6bf3f6116cc64
SHA1 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
SHA512 fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
SSDEEP 3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\chrome_200_percent.pak
Size 222KB
SHA256 fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
MD5 47668ac5038e68a565e0a9243df3c9e5
SHA1 38408f73501162d96757a72c63e41e78541c8e8e
SHA512 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
SSDEEP 6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
MD5 SHA1 SHA512 SSDEEP

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
MD5 SHA1 SHA512 SSDEEP

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\ffmpeg.dll
Size 4.0MB
SHA256 f51ba46aa90587df7294c216d3e0d45f5cbf3a062b04971d96d87647556fa02c
MD5 3c3f780ec6dddfc5803d19dcf0b4a0c1
SHA1 e27813b9c36539d67daba118a58038ba751c2ee5
SHA512 332aa9bff4db2458b7a1742f732e501dec165236b87a062a9fef4b09b734d901d13966b18d5fbe7461b50990585a240fd8b2593def254a7d03e92269f40b8ccc
SSDEEP 49152:VyNmQ8k+OvVJYzhSWaGefjUdcOPpyj4s595Uwv/rrW/hk0ayjZr87n6mfOApbowY:SQcCpyj4Q9D/vWG6jZreyRLBO/JBJ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\icudtl.dat
Size 10.2MB
SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
MD5 e0f1ad85c0933ecce2e003a2c59ae726
SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
MD5 SHA1 SHA512 SSDEEP

Submit Download

installer.db

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\installer.db
Size 20KB
SHA256 18a38d994d00307343a44abf6453248c21aa237da9c067525045542cbb27903d
MD5 92dcdfc5c991cd7a30385f85d51d941d
SHA1 bca4f562a92a7ae36ab54ffbea8f1f902df73966
SHA512 42315acfae89c72d114437ad5195bbb48252af19bfe53598653867d838e8847339e29888fc346b3d43fca5d3d22b95a4fe5863b7269a5412f98c607a65b25897
SSDEEP 192:nVxY//4Vi8LAwnRHmS7Y3AxKaFvebFR/P5w:nVElyhnRFrFvkn5w
MD5 SHA1 SHA512 SSDEEP

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\libEGL.dll
Size 487KB
SHA256 ecf1bdf20e961dec39e84717b653153cee4a70bd55e1d6854804652badfb80d6
MD5 880591a0884a88a60bcfd499243f14fd
SHA1 b09b1c587e1b112359d9a5c63bb9e547dbbe23f6
SHA512 327f1acbe7f8a955572f095e09db956b65940b1eb14b92be18be2df341aaa1dd0f0a94a00f7bef452ad8bb082550d9617f6f0aaca4801f83e94b7c3b1cf98266
SSDEEP 6144:nJFoxlVY1qgRWdXZaI9He7GUPWHu+mFNa198TBDRmg7L:ToxlLgwdXQI9+7GM5Nave/mg7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\libGLESv2.dll
Size 7.5MB
SHA256 0fc406dac7eae10fa86288d5691c6081df39b7171fcdfe73e69d8dd425e46bb3
MD5 dff04251531a9736bbec5c5c1ab10149
SHA1 ad2f87b5979be1bc357095d5711f423c42e41ee8
SHA512 7ba144932052f4fc581f1a1b535c81a4d47d0d4e2ca3a1c5098b748ff215cff8d9dd74fe2faed395cc622761ef576ce6e4a5fc028fc1594c486d90d641645b84
SSDEEP 98304:RUYoH+F/fxq5062J+r0/fqexpDx/JecQqUXm3+J:R/wIg06sq69/SC+J
MD5 SHA1 SHA512 SSDEEP

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\resources.pak
Size 5.1MB
SHA256 546456d9a1328836a99876824f3beb7279f38403cd001515f5d9eb204939e57c
MD5 e9056386a2b4edac9f0ffa829bc0cfa0
SHA1 f8d4b8289ebb088c9997a1fde1c2f12aedd6c82e
SHA512 c49e832e5c16a1846ea882395e83f9cbe9f4f6b44be9f0c7276d0a4495b88091bd95593c5e167dba853834058d7ca823db60d2fac73434ed952b7064b2daf6da
SSDEEP 98304:pt1j254CJgWPVcz+cd31rJ7JBXbwHgf31/LrwrWBpcdmTHWCF3UlfPcauPFcHNp:ptp84CJPdB831FJ5wHwlzkrWBQmTHWoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

snapshot_blob.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\snapshot_blob.bin
Size 270KB
SHA256 b6bea91727efb8c88e7c059856553d3a47abd883e60dd60efc01b04dc6eec621
MD5 d20922aefcad14dc658a3c6fd5ff6529
SHA1 75ce20814bdbe71cfa6fab03556c1711e78ca706
SHA512 dbd63a9f01feb3c389c11b55d720b5d689558626041fb1dd27ded2be602e5e2a8d210f785fde025d7b9959f81de3df7fef06981269b58be564df05aec190dd1c
SSDEEP 3072:FPXttcgbBDoChde06wbRMYKHUeynXtxZ4fQe1:tXPh9oCWCNMXo6
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.node

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\updater.node
Size 3.9MB
SHA256 f8e42cf2e08bcd16b014db0dc1f67a535f41d98c0147d895e5c7bc28ef8a9ecc
MD5 54a7b60f562a61cbc551a27cccb49931
SHA1 d8b0f0cdd7f455b2245eee091dbb1f8cf6e79672
SHA512 fb5d1db1737a7754dca32d7ecd4c6b5ffd865fd480139c61f4770fe6acfa6a08a6776f6cc18836dcf7e95180caafcde0089c1e408796bd8cca80a390905b21f8
SSDEEP 49152:nLlPtAsHH89lr6fcNMMWR2BmBWyIheukawHHipcOe+8rR9DJdZq+zkULRn1BXOaL:n5JVMAMJNkRIS1OasSRw/FO
MD5 SHA1 SHA512 SSDEEP

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\v8_context_snapshot.bin
Size 627KB
SHA256 2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918
MD5 1e4da0bc6404552f9a80ccde89fdef2b
SHA1 838481b9e4f1d694c948c0082e9697a5ed443ee2
SHA512 054917652829af01977e278cd0201c715b3a1280d7e43035507e4fa61c1c00c4cd7ed521c762aebd2ea2388d33c3d4d4b16cee5072d41e960021b6f38745a417
SSDEEP 6144:LlAKlrnVVc/eK7cPg9oCWCNM+MFjfjfGJCWXecRvUsoA4EytPcAzCYY:LZ0t7cP+Yz7Vcrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\vk_swiftshader.dll
Size 5.0MB
SHA256 8a64ec86334666091f56e04dba1cb10389add22dc155e4c45ac6fa642cab57da
MD5 700157cfec9d351080312a53b7d0efb7
SHA1 837ed874e8cce1c4622e97c9715fce3bb9c5fb27
SHA512 bd06ae31f7de7888f9c2bbfc229d82d593b810ff4568d4f4c22287070f9131ec33ea327db36195d3ed3c18a83aa6c576c24d22894a5c5894e8bf1c661a14c316
SSDEEP 49152:xuOm8I24brfEHP+yLywhV8W0z4yXGpr8/n79C5QG+2GeV8X2qoyOGbXr4Zmttk2K:hm8CJAwl1d6sEu8WtUidUCqR
MD5 SHA1 SHA512 SSDEEP

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
MD5 SHA1 SHA512

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\vulkan-1.dll
Size 945KB
SHA256 d64c98adf9a0949f4f30f562584c5efad4f2ee4bca5582ae7d4d0306d493b083
MD5 d56cad44ac2427b45d68288daa51f843
SHA1 e870f8af60e2e5886447ea150080b1239535d1c6
SHA512 238c1371446b2623943831badbba7564b75466a1dbf20db5d1f018e12171389c0369be8abee8a2bff34fa5f062168336d48736596a27b813c5739e3ce3550b1d
SSDEEP 24576:OH26QvC/bdQaqYV3aCDui8ZwV6Z5WdDYsH26g3P0zAk7JXsTm:ONQvbD8lDIZq6Z5WdDYsH26g3P0zAk7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\Discord\packages\RELEASES
Size 81B
SHA256 732fca23c9deaab2aec377e2bbba5905983a5545c2a8c7eecdded379b59699b6
MD5 a7657c3d29ffa0c38fa0710c4a057a18
SHA1 5300f1c026ad4858951eb8b38c1eda03369f2161
SHA512 886bee5b25822ada19a411eda1b5bbb98b83740a1b17d96e915dcdc0c835d81bd2d9e83cb49fc4299aac52722c51007d3ceee3229f070fa7a0accafec2c7a07c
MD5 SHA1 SHA512

Submit Download

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\SquirrelTemp\SquirrelSetup.log
Size 50KB
SHA256 0ea6f718b93083dce3b0a3a350c319329dfab17dd8baee992fbbeb691565c903
MD5 b0aab5be44b01934f092d55e97d09cdb
SHA1 048e54d731503493957c13f8fb61728bfce12313
SHA512 55c7e5078eaf83929087ca0e320f0f16410185e5b6e37da25ad1f04b5bdf8728377ca481d94088e6bd6e09076a1821437a8d99b61f0c233226fa9685d51070aa
SSDEEP 768:zayv1pFpFpapapapapPpPpPpkpkpkpkpdpdpYpYpYpYpzpzpzpzpupupupupsfo+:m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.5MB
SHA256 59b4c3fd71a9d602778ac9479c101c87c9ec0ef28d9a986c6222ed965cad21c8
MD5 172a25012639d2177d4218d386953f6d
SHA1 f7a937a8d9fa267cf2cfd9f7ebfbbef0618c91f5
SHA512 c8d318e3eb81928d1e781182fc59a57395353443e9d33548316238f3cafcbb2de40e0978d17147a5a3a021b168f24144222246d2749dca1a4a10bff3662a0a80
SSDEEP 12288:D6CyLEgR0ro/0EhcXAHjRYSN9bUlOr/oJfT9Pu0XejfQ1JRQ3Tzvx+nDIpnUm:kEgRN/th3VelBPu0XUfWJms0pn3
MD5 SHA1 SHA512 SSDEEP

Submit Download

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\Temp\SquirrelSetup.log
Size 67B
SHA256 9d21a1ecc5c75108e77e1da43a323fd496bd88a1a3926f140a8d039216754db7
MD5 b226fc53ef7c9647dc4afbce9c03dd61
SHA1 d07960ff351e5112c5ed83d6f496cf7f7f64b308
SHA512 56caf080c7286bbd0f964caaeb64838edccedca7a1a80ef3a11c053f4408046beac12f7e1f2077fd93a90d027a18e9051a6557d30c0a2f23c2de20f0c154de7a
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_asyncio.pyd
Size 69KB
SHA256 5bebeb765ab9ef045bc5515166360d6f53890d3ad6fc360c20222d61841410b6
MD5 477dba4d6e059ea3d61fad7b6a7da10e
SHA1 1f23549e60016eeed508a30479886331b22f7a8b
SHA512 8119362c2793a4c5da25a63ca68aa3b144db7e4c08c80cbe8c8e7e8a875f1bd0c30e497208ce20961ddb38d3363d164b6e1651d3e030ed7b8ee5f386faf809d2
SSDEEP 1536:VoxWFyB9uENvvAdAkc0TTILNPIasWxtISOno7Sysxg:ViWFyRNv4drc0TTILNPfsgtISOnoN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_bz2.pyd
Size 83KB
SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
MD5 5bebc32957922fe20e927d5c4637f100
SHA1 a94ea93ee3c3d154f4f90b5c2fe072cc273376b3
SHA512 afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6
SSDEEP 1536:i2sz7yc51BVo1QX/FPI11IK1cDm015ssO687sjkD1ISCV087Syyxt+:dsz2c5eQXB4am05spd7MkD1ISCVzL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_cffi_backend.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_cffi_backend.cp312-win_amd64.pyd
Size 178KB
SHA256 d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7
MD5 0572b13646141d0b1a5718e35549577c
SHA1 eeb40363c1f456c1c612d3c7e4923210eae4cdf7
SHA512 67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842
SSDEEP 3072:YRAMUp3K6YoDssyudy4VcRG+nR3hnW3mjwwOdkS9S7iSSTLkK/jftw3buz:Y6MyK65ssy+MG+LnSUwjD9zSSTLL/jl8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_ctypes.pyd
Size 122KB
SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
MD5 fb454c5e74582a805bc5e9f3da8edc7b
SHA1 782c3fa39393112275120eaf62fc6579c36b5cf8
SHA512 727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d
SSDEEP 3072:CXw32spTVYgFoj6N2xE9sb7VFf/EkZBq5syCtYPU9pISLPTj:CgGEOgFoj68ksTf/ENs7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_decimal.pyd
Size 251KB
SHA256 b8221d1c9e2c892dd6227a6042d1e49200cd5cb82adbd998e4a77f4ee0e9abf1
MD5 492c0c36d8ed1b6ca2117869a09214da
SHA1 b741cae3e2c9954e726890292fa35034509ef0f6
SHA512 b8f1c64ad94db0252d96082e73a8632412d1d73fb8095541ee423df6f00bc417a2b42c76f15d7e014e27baae0ef50311c3f768b1560db005a522373f442e4be0
SSDEEP 6144:vnXBJvhy8AJOMg4hmRWw710z4ez9qWM53pLW1AW/ZJJJWtCk1mGc:ByJJOMiRW+10EHFpNc
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_hashlib.pyd
Size 64KB
SHA256 fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354
MD5 da02cefd8151ecb83f697e3bd5280775
SHA1 1c5d0437eb7e87842fde55241a5f0ca7f0fc25e7
SHA512 a13bc5c481730f48808905f872d92cb8729cc52cfb4d5345153ce361e7d6586603a58b964a1ebfd77dd6222b074e5dcca176eaaefecc39f75496b1f8387a2283
SSDEEP 1536:JgHpgE4Z27b4ZWZnEmIAtISOIx7SyZUxN:i14ZeEmIAtISOIx7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_lzma.pyd
Size 156KB
SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
MD5 195defe58a7549117e06a57029079702
SHA1 3795b02803ca37f399d8883d30c0aa38ad77b5f2
SHA512 c47a9b1066dd9744c51ed80215bd9645aab6cc9d6a3f9df99f618e3dd784f6c7ce6f53eabe222cf134ee649250834193d5973e6e88f8a93151886537c62e2e2b
SSDEEP 3072:Bsvkxuqgo7e2uONqG+hi+CSznfF9mNopXnmnu1ISZ1Vk:BnuFo7Jg1NYOp2uO
MD5 SHA1 SHA512 SSDEEP

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_multiprocessing.pyd
Size 34KB
SHA256 3c34031b464e7881d8f9d182f7387a86b883581fd020280ec56c1e3ec6f4cc2d
MD5 2bd43e8973882e32c9325ef81898ae62
SHA1 1e47b0420a2a1c1d910897a96440f1aeef5fa383
SHA512 9d51bbd25c836f4f5d1fb9b42853476e13576126b8b521851948bdf08d53b8d4b4f66d2c8071843b01aa5631abdf13dc53c708dba195656a30f262dce30a88ca
SSDEEP 768:W1Rp7eiajKCQnAxQ0zdudISWtl5YiSyvUAMxkEk:CRteiauAxQ0zIdISWtr7SyaxA
MD5 SHA1 SHA512 SSDEEP

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_overlapped.pyd
Size 54KB
SHA256 d5f89859609371393d379b5ffd98e5b552078050e8b02a8e2900fa9b4ee8ff91
MD5 7e4553ca5c269e102eb205585cc3f6b4
SHA1 73a60dbc7478877689c96c37107e66b574ba59c9
SHA512 65b72bc603e633596d359089c260ee3d8093727c4781bff1ec0b81c8244af68f69ff3141424c5de12355c668ae3366b4385a0db7455486c536a13529c47b54ef
SSDEEP 1536:Zinr44gaZPXxCJ/+yZdDDrhISXtl7SyVxy:ZXJ/+yZdDDrhISXtlM
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_queue.pyd
Size 31KB
SHA256 dbdabb5fe0ccbc8b951a2c6ec033551836b072cab756aaa56b6f22730080d173
MD5 b7e5fbd7ef3eefff8f502290c0e2b259
SHA1 9decba47b1cdb0d511b58c3146d81644e56e3611
SHA512 b7568b9df191347d1a8d305bd8ddd27cbfa064121c785fa2e6afef89ec330b60cafc366be2b22409d15c9434f5e46e36c5cbfb10783523fdcac82c30360d36f7
SSDEEP 768:xOz+R6rbVKMoNpISQUA5YiSyv86lAMxkEzc:xjgbVJoNpISQUS7SyU6dxPc
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_socket.pyd
Size 81KB
SHA256 b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085
MD5 dd8ff2a3946b8e77264e3f0011d27704
SHA1 a2d84cfc4d6410b80eea4b25e8efc08498f78990
SHA512 958224a974a3449bcfb97faab70c0a5b594fa130adc0c83b4e15bdd7aab366b58d94a4a9016cb662329ea47558645acd0e0cc6df54f12a81ac13a6ec0c895cd8
SSDEEP 1536:ldcydNgIznrvGvLfo4o7zfqwXJ9/s+S+pzo08/n1IsJhv6cpISLwV97Sy7UxV:l6ydrr+DgxjqwXJ9/sT+pzoN1IwhScpf
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_ssl.pyd
Size 174KB
SHA256 a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
MD5 c87c5890039c3bdb55a8bc189256315f
SHA1 84ef3c2678314b7f31246471b3300da65cb7e9de
SHA512 e750dc36ae00249ed6da1c9d816f1bd7f8bc84ddea326c0cd0410dbcfb1a945aac8c130665bfacdccd1ee2b7ac097c6ff241bfc6cc39017c9d1cde205f460c44
SSDEEP 3072:AHtmUArl7bOGLbfbmeq2wfq6XDQJsY2GvMe1ba+VRJNI7IM/H9o/PCrXuI51ISCQ:Ym5lfOGLbjBOq6XD4MejTGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_uuid.pyd
Size 25KB
SHA256 acbf831004fb8b8d5340fe5debd9814c49bd282dd765c78faeb6bb5116288c78
MD5 50521b577719195d7618a23b3103d8aa
SHA1 7020d2e107000eaf0eddde74bc3809df2c638e22
SHA512 4ee950da8bbbd36932b488ec62fa046ac8fc35783a146edadbe063b8419a63d4dfb5bbd8c45e9e008fe708e6fc4a1fee1202fce92ffc95320547ba714fed95e1
SSDEEP 384:BxIRRiAW1ISZwVjHQIYiSy1pCQQWYAM+o/8E9VF0NyGpnXa:cRR3W1ISZw95YiSyvCAMxkEAa
MD5 SHA1 SHA512 SSDEEP

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\_wmi.pyd
Size 36KB
SHA256 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
MD5 8a9a59559c614fc2bcebb50073580c88
SHA1 4e4ced93f2cb5fe6a33c1484a705e10a31d88c4d
SHA512 9b17c81ff89a41307740371cb4c2f5b0cf662392296a7ab8e5a9eba75224b5d9c36a226dce92884591636c343b8238c19ef61c1fdf50cc5aa2da86b1959db413
SSDEEP 768:9mqQhTcYv/NxO01ISCiO5YiSyvoAMxkEzef:9m7GINxO01ISCik7SyOxvef
MD5 SHA1 SHA512 SSDEEP

Submit Download

_helpers.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\aiohttp\_helpers.cp312-win_amd64.pyd
Size 54KB
SHA256 ce240f6083ce39978dd8632e7edc3a2615fc2c49e980933e889ac4b792ea053c
MD5 3f76cb8904f4b8f5a51db73fb4aa07b2
SHA1 b9068c49b3aad120a6eee9dd6835ee2c7157e63a
SHA512 f6f71456c3658c9d6cb8925e3aaf916a30b96294459ad297aef2b50a48436a12de1cbab399d73c6191dca0519786ae7741fc28e748a1b03bdd345d5d2180d2f6
SSDEEP 768:PgoCh6TpXcvw45apLsxayZo7dat2aQAk/gWxqVA0qnlzFds6iY2Yc:PgoCHo4GLoayQdaXAgWwO7k6iYi
MD5 SHA1 SHA512 SSDEEP

Submit Download

_http_parser.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\aiohttp\_http_parser.cp312-win_amd64.pyd
Size 256KB
SHA256 66703e7393eac594a94b2f809c91f5770e6de81640911f99b915ed3d8f671c07
MD5 b9629419e22e48200e565ecef78a28aa
SHA1 af0fa5f14776fff7ea43e9e72e04bc9c87b79ad7
SHA512 b173c23598fc7de7c3b3def188d9a2836d7c16711c5d7be199c0eeeb3c0836885c4f555a99a3407b6aecf3ea25c1fcd93b668f700293eb94a30c8fea5f8b660f
SSDEEP 3072:61KrrDQq2XY9ffolzbw/lVWzEwEvOGn0jLwI6xLjFFLULKYPkQMhHDC0jnygE4H:9rfQqsyfsfW0EwEG4aLwPjrSmS4H
MD5 SHA1 SHA512 SSDEEP

Submit Download

_http_writer.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\aiohttp\_http_writer.cp312-win_amd64.pyd
Size 49KB
SHA256 041e6821db9ecfd6579d9ada9182de03ecbb0375d60b3e355a1c7de02e0e77a6
MD5 3307e43349b363267a4c10a8c2899670
SHA1 b616f04f5cbe7db04706001454253c176287d6b2
SHA512 4b4257396cc8063b99c439caf346d005ca7992b60afcb05bdcd4384290030463622ef2f1572c22b99798e3d88a94dd48456e65e840baf44dc5a33dea27ba14c9
SSDEEP 768:SOSh5N3QXscVJdPEVuz+YCdvoimYlFOdRNgMv9jGAJYL:SOSh5ZcVsozcdvdANgMv9DJYL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_websocket.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\aiohttp\_websocket.cp312-win_amd64.pyd
Size 36KB
SHA256 cf3bc8d2286870c4298c25fd62bf475615e62765d930cebd5f6f0be889e86545
MD5 8307d21acde99544f20c7fc5c37d3e1c
SHA1 757f61b05d8924b7c02a742a51ea68b7ff89a35f
SHA512 6bdbecf166641d5e7eeddb8b08d32c50f60ec65a0abb694dcf649eaade35c887d6e00238cbedb2cc0ff6a384f1d850ac0dcfc5a6766209623421fac2a525fd58
SSDEEP 768:kfLEg0eaNTyighez62DKg5fE8+jcrcDPLQrExv5ke:0XKNTyigOTDK2E8mLQrExx
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\base_library.zip
Size 1.3MB
SHA256 29556cc179d145e9f64d287f0455991bd62a8dc4304e20429f83a1a40959fd09
MD5 68f96a1f0b49d240b392ebb7ea147939
SHA1 5d8aa0cccc0f744f17e546ef7120308016cb5438
SHA512 b326d5feb4f9b3d76254240dc3b0d16cb60c0a47d75ab7a1742fe7bb0bdfafff00a9d24a4c84559f1b2b04d23fd4f53d3b8d654532cb7c57c60bb83041331d35
SSDEEP 24576:NttcY+hnSPL/L+qhadmAPeeKgcaYcQfmq:ztcY+hnHqCkV3
MD5 SHA1 SHA512 SSDEEP

Submit Download

_frozenlist.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\frozenlist\_frozenlist.cp312-win_amd64.pyd
Size 84KB
SHA256 886375bc6f0ff2bbd1e8280f8f1cb29c93f94b8e25b5076043cd796654c3a193
MD5 d7193bea71087b94502c6b3a40120b04
SHA1 51aa3825a885a528356ba339f599c557e9973ec3
SHA512 c65cef39362a75814d40132f4f54f25f258c484dd011b12ae7051fa52865f025c960e4a3130c699b7eb1be375a3d2c3c3b733d6543338d7e40aad0488d305056
SSDEEP 1536:OwsZ607E6QFvkncm4nraT1G5YDHykXxA:o80w6QFsMWpG5YDHdXx
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

_multidict.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\multidict\_multidict.cp312-win_amd64.pyd
Size 45KB
SHA256 1ef9e6eaff88cdcc0a32346b7b266a0e1d19716ecac07f16a189a7057ce971f9
MD5 ab3685f651c7821bbf03baf1d436b617
SHA1 f6306217ecaf5fa1dc8c78260d02dd2716903316
SHA512 08e4d615ce5f9c565d54a16b1f475b6ad746b5d8e7f17248d235b5acd474333036bb33671c887bb64794b56ec910af28efbb7bed8bdea2eddd4bcd81c1b1fb70
SSDEEP 768:Z/wQrRHsQieOL0Jr4X+avKbrwtbrqM1L4bHB:lwesQOL0Jr4X+avOrO4b
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\pyexpat.pyd
Size 197KB
SHA256 efd6099b1a6efdadd988d08dce0d8a34bd838106238250bccd201dc7dcd9387f
MD5 958231414cc697b3c59a491cc79404a7
SHA1 3dec86b90543ea439e145d7426a91a7aca1eaab6
SHA512 fd29d0aab59485340b68dc4552b9e059ffb705d4a64ff9963e1ee8a69d9d96593848d07be70528d1beb02bbbbd69793ee3ea764e43b33879f5c304d8a912c3be
SSDEEP 6144:Znguk4rd6FjFMww6c+K+7X5icE878J0JhivihkzOv/:PrrYivi9v/
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\python3.DLL
Size 66KB
SHA256 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
MD5 a07661c5fad97379cf6d00332999d22c
SHA1 dca65816a049b3cce5c4354c3819fef54c6299b0
SHA512 6ddeb9d89ccb4d2ec5d994d85a55e5e2cc7af745056dae030ab8d72ee7830f672003f4675b6040f123fc64c19e9b48cabd0da78101774dafacf74a88fbd74b4d
SSDEEP 768:GV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/L:GDmF61JFn+/OxpISL0v7Syqx0
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\python312.dll
Size 6.6MB
SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
MD5 d521654d889666a0bc753320f071ef60
SHA1 5fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA512 7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3
SSDEEP 49152:PPknDqOJlpxSupRo2vXDZ2lgghXQIX2CG4Ts99kdwQAvyodh1GCOepxk1NHh8yfE:kdlpx9p5Loehv6JfDvXHDMiETH+0Tn
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\select.pyd
Size 30KB
SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
MD5 d0cc9fc9a0650ba00bd206720223493b
SHA1 295bc204e489572b74cc11801ed8590f808e1618
SHA512 d3ebcb91d1b8aa247d50c2c4b2ba1bf3102317c593cbf6c63883e8bf9d6e50c0a40f149654797abc5b4f17aee282ddd972a8cd9189bfcd5b9cec5ab9c341e20b
SSDEEP 384:2RVBC9t6Lhz64wHqFslDT90YpISQGrHQIYiSy1pCQ+42AM+o/8E9VF0Nyes:YGyIHqG1HpISQG75YiSyvB2AMxkEp
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\unicodedata.pyd
Size 1.1MB
SHA256 bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268
MD5 cc8142bedafdfaa50b26c6d07755c7a6
SHA1 0fcab5816eaf7b138f22c29c6d5b5f59551b39fe
SHA512 c3b0c1dbe5bf159ab7706f314a75a856a08ebb889f53fe22ab3ec92b35b5e211edab3934df3da64ebea76f38eb9bfc9504db8d7546a36bc3cabe40c5599a9cbd
SSDEEP 12288:LrEHdcM6hbqCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAjL:LrEXPCjfk7bPNfv42BN6yzUAjL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_quoting_c.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41442\yarl\_quoting_c.cp312-win_amd64.pyd
Size 94KB
SHA256 f306e375e186c011585dea2bc875530fb7d734861db388764a2aa307b1b68df3
MD5 44eb05d3c409e626ad417ed117068160
SHA1 dc0c4446e0601a2d341a09cda68ce6d2e466c040
SHA512 51194721d5ed968d40394f784a4708e6282d7c28b45b387165ae44eb5798f58432e85f743f798dae2c79722c88f5e8bb61c31ea37110781aa2368c6b4a4a45a2
SSDEEP 1536:Uuv1GVExBOFbzGuw5HB7WWzwVQZhOtoXoJ1OTOKbcJ18UmrH53:ldKEqnw5h7fhwGS1OTOKb+18UwZ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/2596-166-0x00000000076E0000-0x0000000007718000-memory.dmp

Download

memory/2596-167-0x00000000076C0000-0x00000000076CE000-memory.dmp

Download

memory/2596-165-0x0000000007660000-0x0000000007668000-memory.dmp

Download

memory/3600-151-0x0000000000770000-0x00000000008E6000-memory.dmp

Download

memory/3680-605-0x00007FF6555D0000-0x00007FF6565D0000-memory.dmp

Download

memory/5168-531-0x00000000050D0000-0x00000000050F0000-memory.dmp

Download