Analysis Overview
Threat Level: Likely malicious
The file https://github.com/Vencord/Installer/releases/latest/download/VencordInstaller.exe was found to be: Likely malicious.
Malicious Activity Summary
Downloads MZ/PE file
Loads dropped DLL
Reads local data of messenger clients
Executes dropped EXE
Checks computer location settings
Legitimate hosting services abused for malware hosting/C2
Adds Run key to start application
Drops file in Program Files directory
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Enumerates system info in registry
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies data under HKEY_USERS
Checks processor information in registry
Modifies registry class
Modifies registry key
Suspicious use of AdjustPrivilegeToken
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-12 14:12
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-12 14:12
Reported
2024-06-12 14:15
Platform
win10v2004-20240611-en
Max time kernel
142s
Max time network
147s
Command Line
Signatures
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Discord\Update.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Discord\Update.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Discord\Update.exe | N/A |
Executes dropped EXE
Loads dropped DLL
Reads local data of messenger clients
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe\" --processStart Discord.exe" | C:\Windows\System32\reg.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\chrome_url_fetcher_5096_241662274\oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win64_adsurwm4gclupf32xdrpgdnapira.crx3 | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| File created | C:\Program Files\chrome_url_fetcher_5096_1615128595\neifaoindggfcjicffkgpmnlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3 | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
Enumerates physical storage devices
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord | C:\Windows\System32\reg.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\DefaultIcon | C:\Windows\System32\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9148\\Discord.exe\",-1" | C:\Windows\System32\reg.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord | C:\Windows\System32\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9148\\Discord.exe\" --url -- \"%1\"" | C:\Windows\System32\reg.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord | C:\Windows\System32\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\ = "URL:Discord Protocol" | C:\Windows\System32\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\URL Protocol | C:\Windows\System32\reg.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\shell\open\command | C:\Windows\System32\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\ = "URL:Discord Protocol" | C:\Windows\System32\reg.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\shell\open\command | C:\Windows\System32\reg.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\shell\open | C:\Windows\System32\reg.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\shell | C:\Windows\System32\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9148\\Discord.exe\",-1" | C:\Windows\System32\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Discord\\app-1.0.9148\\Discord.exe\" --url -- \"%1\"" | C:\Windows\System32\reg.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\DefaultIcon | C:\Windows\System32\reg.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord | C:\Windows\System32\reg.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord | C:\Windows\System32\reg.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Discord\URL Protocol | C:\Windows\System32\reg.exe | N/A |
Modifies registry key
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\reg.exe | N/A |
| N/A | N/A | C:\Windows\System32\reg.exe | N/A |
| N/A | N/A | C:\Windows\System32\reg.exe | N/A |
| N/A | N/A | C:\Windows\System32\reg.exe | N/A |
| N/A | N/A | C:\Windows\System32\reg.exe | N/A |
| N/A | N/A | C:\Windows\System32\reg.exe | N/A |
| N/A | N/A | C:\Windows\System32\reg.exe | N/A |
| N/A | N/A | C:\Windows\System32\reg.exe | N/A |
| N/A | N/A | C:\Windows\System32\reg.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\VencordInstaller.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Vencord/Installer/releases/latest/download/VencordInstaller.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a60dab58,0x7ff9a60dab68,0x7ff9a60dab78
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1904 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2284 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4812 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4936 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5020 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4860 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4076 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5268 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5000 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5100 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3216 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4508 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x394 0x150
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1752 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Users\Admin\Downloads\VencordInstaller.exe
"C:\Users\Admin\Downloads\VencordInstaller.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5004 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5012 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1748 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5092 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1536 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:8
C:\Users\Admin\Downloads\DiscordSetup.exe
"C:\Users\Admin\Downloads\DiscordSetup.exe"
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --squirrel-install 1.0.9148
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9148 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x518,0x51c,0x520,0x50c,0x524,0x7ff705193108,0x7ff705193114,0x7ff705193120
C:\Users\Admin\AppData\Local\Discord\Update.exe
C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2024 --field-trial-handle=2028,i,4104843626655920762,415390795952557326,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --mojo-platform-channel-handle=2436 --field-trial-handle=2028,i,4104843626655920762,415390795952557326,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f
C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe\",-1" /f
C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe\" --url -- \"%1\"" /f
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3044 --field-trial-handle=1976,i,12433040950041318183,12032466540793321111,131072 /prefetch:2
C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe"
C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9148 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x50c,0x510,0x514,0x500,0x518,0x7ff705193108,0x7ff705193114,0x7ff705193120
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe"
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2584 --field-trial-handle=2604,i,8753410459146296791,17012526776023649830,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=2816 --field-trial-handle=2604,i,8753410459146296791,17012526776023649830,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=0 --gpu-device-id=0 --gpu-sub-system-id=0 --gpu-revision=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2920 --field-trial-handle=2604,i,8753410459146296791,17012526776023649830,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=2604,i,8753410459146296791,17012526776023649830,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9148 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x4e4,0x4e8,0x4ec,0x4e0,0x4f0,0x7ff705193108,0x7ff705193114,0x7ff705193120
C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2064 --field-trial-handle=2076,i,14204615761767500760,15328618854549838924,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --mojo-platform-channel-handle=2164 --field-trial-handle=2076,i,14204615761767500760,15328618854549838924,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe\",-1" /f
C:\Windows\System32\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe\" --url -- \"%1\"" /f
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe"
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9148 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=28.2.10 --initial-client-data=0x4e8,0x4ec,0x4f0,0x4e4,0x4f4,0x7ff705193108,0x7ff705193114,0x7ff705193120
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1856 --field-trial-handle=1860,i,2245761734295445096,11526465612641476802,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --mojo-platform-channel-handle=2400 --field-trial-handle=1860,i,2245761734295445096,11526465612641476802,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=3800 --field-trial-handle=2604,i,8753410459146296791,17012526776023649830,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\Discord.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=disclip --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip --mojo-platform-channel-handle=4124 --field-trial-handle=2604,i,8753410459146296791,17012526776023649830,262144 --enable-features=kWebSQLAccess --disable-features=CalculateNativeWinOcclusion,HardwareMediaKeyHandling,MediaSessionService,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| NL | 23.62.61.90:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 90.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 196.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 172.217.169.46:443 | play.google.com | udp |
| GB | 172.217.169.46:443 | play.google.com | tcp |
| US | 8.8.8.8:53 | 46.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | encrypted-tbn1.gstatic.com | udp |
| GB | 142.250.178.14:443 | encrypted-tbn1.gstatic.com | tcp |
| GB | 142.250.178.14:443 | encrypted-tbn1.gstatic.com | tcp |
| US | 8.8.8.8:53 | 14.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | consent.google.com | udp |
| GB | 142.250.187.238:443 | consent.google.com | tcp |
| US | 8.8.8.8:53 | 238.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | content-autofill.googleapis.com | udp |
| GB | 216.58.212.234:443 | content-autofill.googleapis.com | tcp |
| US | 8.8.8.8:53 | 234.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.136.232:443 | discord.com | tcp |
| US | 162.159.136.232:443 | discord.com | tcp |
| US | 162.159.136.232:443 | discord.com | udp |
| US | 8.8.8.8:53 | cdn.prod.website-files.com | udp |
| US | 8.8.8.8:53 | global.localizecdn.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| US | 8.8.8.8:53 | 232.136.159.162.in-addr.arpa | udp |
| GB | 142.250.200.10:443 | ajax.googleapis.com | tcp |
| GB | 142.250.200.10:443 | ajax.googleapis.com | tcp |
| US | 104.18.5.175:443 | global.localizecdn.com | tcp |
| US | 104.18.34.227:443 | cdn.prod.website-files.com | tcp |
| US | 8.8.8.8:53 | d3e54v103j8qbb.cloudfront.net | udp |
| US | 104.18.34.227:443 | cdn.prod.website-files.com | udp |
| US | 8.8.8.8:53 | assets.website-files.com | udp |
| CH | 13.224.98.50:443 | d3e54v103j8qbb.cloudfront.net | tcp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| CH | 13.224.98.50:443 | d3e54v103j8qbb.cloudfront.net | tcp |
| US | 8.8.8.8:53 | 202.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.5.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.34.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.98.224.13.in-addr.arpa | udp |
| US | 104.18.34.227:443 | cdn.prod.website-files.com | udp |
| US | 8.8.8.8:53 | geolocation.onetrust.com | udp |
| US | 172.64.155.119:443 | geolocation.onetrust.com | tcp |
| CH | 18.165.183.18:443 | assets.website-files.com | tcp |
| CH | 18.165.183.18:443 | assets.website-files.com | tcp |
| CH | 18.165.183.18:443 | assets.website-files.com | tcp |
| CH | 18.165.183.18:443 | assets.website-files.com | tcp |
| CH | 18.165.183.18:443 | assets.website-files.com | tcp |
| CH | 18.165.183.18:443 | assets.website-files.com | tcp |
| US | 8.8.8.8:53 | 104.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.155.64.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.183.165.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.130.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.youtube.com | udp |
| US | 8.8.8.8:53 | a.nel.cloudflare.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 8.8.8.8:53 | 1.80.190.35.in-addr.arpa | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.53.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.24.18.2.in-addr.arpa | udp |
| US | 162.159.136.232:443 | discord.com | udp |
| US | 104.18.34.227:443 | cdn.prod.website-files.com | udp |
| GB | 142.250.200.10:443 | ajax.googleapis.com | udp |
| US | 104.18.5.175:443 | global.localizecdn.com | udp |
| CH | 18.165.183.18:443 | assets.website-files.com | tcp |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| GB | 172.217.169.67:443 | beacons.gcp.gvt2.com | tcp |
| GB | 142.250.200.46:443 | www.youtube.com | udp |
| US | 8.8.8.8:53 | 46.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.github.com | udp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | 210.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | assets.website-files.com | udp |
| US | 8.8.8.8:53 | d3e54v103j8qbb.cloudfront.net | udp |
| CH | 13.224.98.50:443 | d3e54v103j8qbb.cloudfront.net | tcp |
| US | 8.8.8.8:53 | beacons4.gvt2.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 8.8.8.8:53 | dl.discordapp.net | udp |
| US | 104.18.48.115:443 | dl.discordapp.net | tcp |
| US | 8.8.8.8:53 | 115.48.18.104.in-addr.arpa | udp |
| US | 216.239.32.116:443 | beacons4.gvt2.com | tcp |
| US | 8.8.8.8:53 | 116.32.239.216.in-addr.arpa | udp |
| US | 216.239.32.116:443 | beacons4.gvt2.com | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | update.googleapis.com | udp |
| US | 8.8.8.8:53 | update.googleapis.com | udp |
| GB | 142.250.187.195:443 | update.googleapis.com | tcp |
| GB | 142.250.187.195:443 | update.googleapis.com | tcp |
| US | 8.8.8.8:53 | updates.discord.com | udp |
| US | 162.159.137.232:443 | updates.discord.com | tcp |
| US | 8.8.8.8:53 | 195.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 123.35.104.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.137.159.162.in-addr.arpa | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| GB | 172.217.169.67:443 | beacons.gcp.gvt2.com | udp |
| GB | 142.250.187.195:443 | update.googleapis.com | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:53 | dns.google | udp |
| US | 8.8.8.8:443 | dns.google | tcp |
| US | 8.8.8.8:443 | dns.google | tcp |
Files
\??\pipe\crashpad_2584_HQCHYVDCASUORJLS
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\Downloads\Unconfirmed 880891.crdownload
| MD5 | 1b8ee61ddcfd1d425821d76ea54ca829 |
| SHA1 | f8daf2bea3d4a6bfc99455d69c3754054de3baa5 |
| SHA256 | dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871 |
| SHA512 | 75ba16ddc75564e84f5d248326908065942ad50631ec30d7952069caee15b8c5411a8802d25d38e9d80e042f1dde97a0326f4ab4f1c90f8e4b81396ca69c229a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | ffaea7686e0212a60a9bcf64c5a5aa04 |
| SHA1 | b52b12bba5bec580fa47623a5277c4d985342e1c |
| SHA256 | b6694996191564ddf11acb04cc977b1645eab170eb7e1434ec97e08f706f9c2d |
| SHA512 | 7079f5b96c9622b90f9b6030b660be0b2a9864531d76d276ce4d14277a5816016ca06a178f1f891a5b730cdedfa8a09e2b4d379cbafadfe619c3e6bf710484c1 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 6becdfd787be6758b4ffd1cea490cd76 |
| SHA1 | 70ac89509b04f337679495be62a3112926c095c4 |
| SHA256 | 65cb7747aa19d9e93cb4e5ab930566b22b5984a569707cfd5d23d58193e581ca |
| SHA512 | 49749f91df64c21370ac88c528dd21180d5fe92d7687329c2a3354b0247bafd8cff1c84f5e4b4a17bccb42a9ac796cc2ebfe8d07b839deda3dcba6c3f79ea875 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 6cdb02749beb3c2c10fbae3728d5a72a |
| SHA1 | 46ac2ff3ad96643bad18e1fddade7e53cdae8f80 |
| SHA256 | 7c24aa6d48c0dfea3ab80f757d4bafedaac1b7c8025de3fdbaa31011c94f45cd |
| SHA512 | 6554658e6fd4fc799fc91cd0cb0bd01cb4d0fe3e9b66ee2ee5b29c2d4d8774cda3f363f74d6e74af7f0596b71c0da80c32617da811564c3c09d85b17a93059e9 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\66fea1c1-dde2-4940-b6eb-80125865a2fa.tmp
| MD5 | 9ca5469069f372e71933163df2b66721 |
| SHA1 | 6f67b751323b0a4b7b07579c53b500908c9673e2 |
| SHA256 | 63795d86a72fc541917128c14f869da0285773ff5caf9e8d1544b9040cf07fe8 |
| SHA512 | 02dc9ba218556dde9a2c5eb4ebbc0f4bd5739082efdcbab2fc863968f1ff315178c65e5d275fb072040d8dd33de4ccff4402e1ca146ed389477abb0db5a2e109 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 9f2aa567c49df50c96e5a461510bee85 |
| SHA1 | f273a38f0ceb98d4a462ffaf3e1fb6dd701ff17a |
| SHA256 | 6292a024d274e49743a00b0c9199ed0f0fde51ba4777e8f640da41d0843f0563 |
| SHA512 | 4a4476e814b2d70bec5e9066ad003ce88c921aa6d818aabde2299d05c55600da1f781f4c0f9490a30b43f9747c39dc998d71ce97d33676dcdf5715a4cc7eceb7 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | aabe8b5ebafc6a5631715302991dfc73 |
| SHA1 | f6d8f38348e3bcfab0a96d5abee8a2935d5334b6 |
| SHA256 | 1004fb907abe7695220e2de1c7e1e53c79c0b2de1edf6e935144a2ae37feb7c4 |
| SHA512 | f972e15aad6bdb973d97ae84de09bcbf86f336e246f97d4ef7329edd8c8b89cf097230be62d1441b87baa5589e7ba7d82423c0fdbe0d710506deca28ef696873 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
| MD5 | f4e1fced711d31324922737f34a18ddd |
| SHA1 | 5e9bb26a6b657225c5582446622a93b4b91f494f |
| SHA256 | d03574d20eec980263aa29ed1b65d61796abfd12e479cd2b6b0b2507f6603f1f |
| SHA512 | 13a1e8b5ef94d899d80a423adbf31b375a50b5f455e2b588346fe4ce0da99aeb9c95e50492aa8952ac2497fc2d6a911fc9c95f9eeee090e2c72969d76bbffc8a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57ac5d.TMP
| MD5 | 62db72128f0e8090e87d3f6d26534012 |
| SHA1 | ffc9690d6b6133013674c303f2df909816df5ada |
| SHA256 | 894e37c27a9e343656809f2f3d99da4b97eac7a2607b7d540ae6ed910d95fb94 |
| SHA512 | fe22c6782a98ea66cb37edfa57ad10f545fbad63a22c191ffe0d7616143a9612823d8c1693152e54503f8eaccd132c1d44fca052d96257995845476b8ace41cf |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 6200c32ea274129b16ae43950815d4cf |
| SHA1 | f2e4c428785101e8cf4e143ba76973d41cd44470 |
| SHA256 | ea4406686e354061ab2f10c0125633dedbea6fab6253b5cbc70a3f75ae8763ee |
| SHA512 | cfef5532bcccbe2cd0ea57377e2f7f358f541963d713a567da67a2f71a5d20c7ca77018c4befc1f6fcf4f94b676d7d21d3c03614372d55865d81a8df2a6e8279 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 1cb61625ed723c59a56e32851133a0b1 |
| SHA1 | 01a94b47ad2cbf7f56d44e6309f6a6909eec31b6 |
| SHA256 | 77b4dc7653a853174e2724fb0f3d7fa257275286848ced15ed5f5cc8619158ae |
| SHA512 | c7c15e34b64562f24a806ed4e20c25890b267af536ae15c8a841266f86715a6caf3e9ef3a906fd9cd615aa984780d42c7a010cb11989e17143df10084d4ad2a8 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ad97f7d207b039b6f90de863fbb10f52 |
| SHA1 | 7eccfac3dfa0e03defdc80048c9ec1662d3f89bb |
| SHA256 | a90523ec68ed34e327d2db2eb96b564d163f9b636b60502458ee9e003a3ec3fb |
| SHA512 | db20d3181a83a92d53dd0c95b1879241db8bef72f3a91e36c1f27fb6b63446e16a84f6c83826c412e7b2318166604398ea275337989ad487a30725be48e803fa |
memory/4604-412-0x00007FF6174E0000-0x00007FF618759000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
| MD5 | 1ac34f04e3482089caf7b171085a2828 |
| SHA1 | 6dc145c312ed5622f618ae1f10d1876f4cfbadee |
| SHA256 | 5f1325e63debef4ef12fa2e8d9e991adfd40210da69ba737f0fd6bb5f0079e6a |
| SHA512 | 669c8ee7fa20fe21337a76d7602a59a32e8020a27f06e0214f71e6fad8f2faaef66efd1a519a7b2c946357df3cc9a55fdb528eabb95ef4a4557156aaf037b339 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 02190495aa3a336c712c1f3f2de5338b |
| SHA1 | eea8c4b4515d865962d075d877010089f1197257 |
| SHA256 | 21ede7a79891f246c241918bd7c94ec571aade7732572eaca37c3eda870ac325 |
| SHA512 | 18ce29e06cc0b89e6bee10238e8bb17a1462e6f980bc74cb4d788c7dae409b10362bbdac97b95f1bf60f2a331ff690e7b98caed6808bcf66c97eb5c184777f9c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 3a8269e505d35aafd206b64a7bcfbbcd |
| SHA1 | af8bc8f5ee6d636b9eb2763bbff02e0cbf9001db |
| SHA256 | 8f3dbf576f7f5f1dd32234df6567aba0fdf3325e7e8c24b2f0d1ee278be4f3f6 |
| SHA512 | ec4cc10fae5947a5efdb41f29ca26909fc1a652dedf20c5bae5e4535e1513b6d36cbd29cfc7735f88f017de399d151e44c28d82b06493dacdd1ac2c6fef7feb6 |
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
| MD5 | 172a25012639d2177d4218d386953f6d |
| SHA1 | f7a937a8d9fa267cf2cfd9f7ebfbbef0618c91f5 |
| SHA256 | 59b4c3fd71a9d602778ac9479c101c87c9ec0ef28d9a986c6222ed965cad21c8 |
| SHA512 | c8d318e3eb81928d1e781182fc59a57395353443e9d33548316238f3cafcbb2de40e0978d17147a5a3a021b168f24144222246d2749dca1a4a10bff3662a0a80 |
memory/412-487-0x0000000000440000-0x00000000005B6000-memory.dmp
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
| MD5 | a7657c3d29ffa0c38fa0710c4a057a18 |
| SHA1 | 5300f1c026ad4858951eb8b38c1eda03369f2161 |
| SHA256 | 732fca23c9deaab2aec377e2bbba5905983a5545c2a8c7eecdded379b59699b6 |
| SHA512 | 886bee5b25822ada19a411eda1b5bbb98b83740a1b17d96e915dcdc0c835d81bd2d9e83cb49fc4299aac52722c51007d3ceee3229f070fa7a0accafec2c7a07c |
memory/412-669-0x00000000120D0000-0x00000000120D8000-memory.dmp
memory/412-671-0x0000000012930000-0x000000001293E000-memory.dmp
memory/412-670-0x0000000012950000-0x0000000012988000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 6453b0eaa9c05b30d2b410ed86363741 |
| SHA1 | a61c00da8245c3823903a537345d646c07af5481 |
| SHA256 | 8779e4416fa0388f2373f84c616392f68a187771ee542386c9ca91f11c4e4571 |
| SHA512 | 60cbfb54bc0a39b27c50d424154314b35a4cb5c1c65409309b4a40c802683af3d2a0547c02b1d6732469e3763899799986ae577772c4c817f373b4966849dee5 |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\ffmpeg.dll
| MD5 | 3c3f780ec6dddfc5803d19dcf0b4a0c1 |
| SHA1 | e27813b9c36539d67daba118a58038ba751c2ee5 |
| SHA256 | f51ba46aa90587df7294c216d3e0d45f5cbf3a062b04971d96d87647556fa02c |
| SHA512 | 332aa9bff4db2458b7a1742f732e501dec165236b87a062a9fef4b09b734d901d13966b18d5fbe7461b50990585a240fd8b2593def254a7d03e92269f40b8ccc |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\v8_context_snapshot.bin
| MD5 | 1e4da0bc6404552f9a80ccde89fdef2b |
| SHA1 | 838481b9e4f1d694c948c0082e9697a5ed443ee2 |
| SHA256 | 2db4a98abe705ef9bc18e69d17f91bc3f4c0f5703f9f57b41acb877100718918 |
| SHA512 | 054917652829af01977e278cd0201c715b3a1280d7e43035507e4fa61c1c00c4cd7ed521c762aebd2ea2388d33c3d4d4b16cee5072d41e960021b6f38745a417 |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\icudtl.dat
| MD5 | e0f1ad85c0933ecce2e003a2c59ae726 |
| SHA1 | a8539fc5a233558edfa264a34f7af6187c3f0d4f |
| SHA256 | f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb |
| SHA512 | 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28 |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\resources\app.asar
| MD5 | 91a273dc1d39acad8781fecd5f57933d |
| SHA1 | 918ae121eafdae53fa029f1aece4e7dfce752112 |
| SHA256 | f819a0553fe7e04e331119cfcd6ed399a05865ff05f0434d0b2e5ef660bef2d2 |
| SHA512 | b406f7f686b56014c198e3df8d80f104cbacb3593ecd21c35003e6820b53092f7269f35d3045b7de9ea370ae258efb0d30639a494af1b59eea3f6563cbb83ef4 |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\resources\build_info.json
| MD5 | 5a3e7b67737956e1e0e985788775062d |
| SHA1 | b861613a795f268ead8b990a85fda1bb3ba74a01 |
| SHA256 | 3d3f8ef59d1323705154516e73d62fa0781b19315372ac2332a82029acced2a4 |
| SHA512 | 86a45e9023b3f82d0f781e64de06d969ef427052063f3e8bf8cb508dc771299af10bcdff6a596e06094a7ad64805c04d3331e98b4d602556b5643f7c5c7546ec |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\app.ico
| MD5 | 084f9bc0136f779f82bea88b5c38a358 |
| SHA1 | 64f210b7888e5474c3aabcb602d895d58929b451 |
| SHA256 | dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43 |
| SHA512 | 65bccb3e1d4849b61c68716831578300b20dcaf1cbc155512edbc6d73dccbaf6e5495d4f95d089ee496f8e080057b7097a628cc104fa8eaad8da866891d9e3eb |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\resources.pak
| MD5 | e9056386a2b4edac9f0ffa829bc0cfa0 |
| SHA1 | f8d4b8289ebb088c9997a1fde1c2f12aedd6c82e |
| SHA256 | 546456d9a1328836a99876824f3beb7279f38403cd001515f5d9eb204939e57c |
| SHA512 | c49e832e5c16a1846ea882395e83f9cbe9f4f6b44be9f0c7276d0a4495b88091bd95593c5e167dba853834058d7ca823db60d2fac73434ed952b7064b2daf6da |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\locales\en-US.pak
| MD5 | 809b600d2ee9e32b0b9b586a74683e39 |
| SHA1 | 99d670c66d1f4d17a636f6d4edc54ad82f551e53 |
| SHA256 | 0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb |
| SHA512 | 9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431 |
memory/4324-724-0x0000000004CD0000-0x0000000004CF0000-memory.dmp
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\libGLESv2.dll
| MD5 | dff04251531a9736bbec5c5c1ab10149 |
| SHA1 | ad2f87b5979be1bc357095d5711f423c42e41ee8 |
| SHA256 | 0fc406dac7eae10fa86288d5691c6081df39b7171fcdfe73e69d8dd425e46bb3 |
| SHA512 | 7ba144932052f4fc581f1a1b535c81a4d47d0d4e2ca3a1c5098b748ff215cff8d9dd74fe2faed395cc622761ef576ce6e4a5fc028fc1594c486d90d641645b84 |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\libEGL.dll
| MD5 | 880591a0884a88a60bcfd499243f14fd |
| SHA1 | b09b1c587e1b112359d9a5c63bb9e547dbbe23f6 |
| SHA256 | ecf1bdf20e961dec39e84717b653153cee4a70bd55e1d6854804652badfb80d6 |
| SHA512 | 327f1acbe7f8a955572f095e09db956b65940b1eb14b92be18be2df341aaa1dd0f0a94a00f7bef452ad8bb082550d9617f6f0aaca4801f83e94b7c3b1cf98266 |
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| SHA512 | 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84 |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\d3dcompiler_47.dll
| MD5 | a7b7470c347f84365ffe1b2072b4f95c |
| SHA1 | 57a96f6fb326ba65b7f7016242132b3f9464c7a3 |
| SHA256 | af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a |
| SHA512 | 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\chrome_200_percent.pak
| MD5 | 47668ac5038e68a565e0a9243df3c9e5 |
| SHA1 | 38408f73501162d96757a72c63e41e78541c8e8e |
| SHA256 | fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32 |
| SHA512 | 5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89 |
C:\Users\Admin\AppData\Local\Discord\app-1.0.9148\chrome_100_percent.pak
| MD5 | 4fc6564b727baa5fecf6bf3f6116cc64 |
| SHA1 | 6ced7b16dc1abe862820dfe25f4fe7ead1d3f518 |
| SHA256 | b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb |
| SHA512 | fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 8b4d26df38ed82714454a5a67472644a |
| SHA1 | 358a243d9ef9578a3467d59b29cdbe99bb5b8bbb |
| SHA256 | 5c16c33748b9ea5ac47d32230e6e062860cbdeeca3a5c50d107e82e76b70ff30 |
| SHA512 | 8eedcbfbd563efb8988ed43ad2f811347c6ea2001252fba9c062a37a8e1ed64dabc5b46d313c7ea37df9df063e576a6d7e9db1c2fe767f5b1dfa21ed99e0574e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | dbcc0df2bd114f7fa481f25b7a3c5315 |
| SHA1 | b7b8a38de811c92b8eadde1d52ce17aa16f23ccd |
| SHA256 | 857383cb16c7272461414054739023dc5d3f3aaa553365c6b4378557efd32be7 |
| SHA512 | 077355320f22c7b807d45314c31e94bcecb6a39d0acd5e14d9504ab6e25a014d3147f9ecc777412f43ec21be5f178df4da98116bb853cef4955e509220187d02 |
memory/3672-824-0x0000023D112A0000-0x0000023D112A1000-memory.dmp
memory/3672-823-0x0000023D112A0000-0x0000023D112A1000-memory.dmp
memory/3672-844-0x0000023D112A0000-0x0000023D112A1000-memory.dmp
memory/3672-843-0x0000023D112A0000-0x0000023D112A1000-memory.dmp
memory/3672-842-0x0000023D112A0000-0x0000023D112A1000-memory.dmp
memory/3672-841-0x0000023D112A0000-0x0000023D112A1000-memory.dmp
memory/3672-840-0x0000023D112A0000-0x0000023D112A1000-memory.dmp
memory/3672-839-0x0000023D112A0000-0x0000023D112A1000-memory.dmp
memory/3672-838-0x0000023D112A0000-0x0000023D112A1000-memory.dmp
memory/3672-822-0x0000023D112A0000-0x0000023D112A1000-memory.dmp
memory/680-864-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-863-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-862-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-861-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-860-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-859-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-858-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-857-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-856-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-855-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-854-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-853-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-852-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-851-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-850-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-849-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-848-0x000001CFCC770000-0x000001CFCC772000-memory.dmp
memory/680-847-0x000001CFCBEF0000-0x000001CFCBEF1000-memory.dmp
memory/680-846-0x000001CFCBEF0000-0x000001CFCBEF1000-memory.dmp
memory/680-845-0x000001CFCBEF0000-0x000001CFCBEF1000-memory.dmp
C:\Users\Admin\AppData\Roaming\discord\Crashpad\settings.dat
| MD5 | 70bea2f55d245952d954197d9822d6bc |
| SHA1 | a175bdec3394e1956c4858347e13af73814678a1 |
| SHA256 | 8547fe1b687e52434f0fa404d3f672ac2f3ed4bea3b024f11cf0ed025b6e4d9d |
| SHA512 | 4e45817e3d9c6cd52967bc7dbf167ed767274ea3784dd87d773dcb1382d0c8f23426f2d944011a1bf38f2607963c1cd9d269b597b04f94d3bfd7482c98be36a6 |
memory/5708-918-0x00007FF9AF020000-0x00007FF9AF021000-memory.dmp
memory/5708-919-0x00007FF9AE550000-0x00007FF9AE551000-memory.dmp
C:\Users\Admin\AppData\Roaming\discord\component_crx_cache\neifaoindggfcjicffkgpmnlppeffabd_1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed
| MD5 | f265d47475ffd3884329d92deefae504 |
| SHA1 | 98c74386481f171b09cb9490281688392eefbfdd |
| SHA256 | c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed |
| SHA512 | 4fd27594c459fb1cd94a857be10f7d1d6216dbf202cd43e8a3fa395a268c72fc5f5c456c9cb314f2220d766af741db469c8bb106acbed419149a44a3b87619f1 |
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5096_412611145\Google.Widevine.CDM.dll
| MD5 | 477c17b6448695110b4d227664aa3c48 |
| SHA1 | 949ff1136e0971a0176f6adea8adcc0dd6030f22 |
| SHA256 | cb190e7d1b002a3050705580dd51eba895a19eb09620bdd48d63085d5d88031e |
| SHA512 | 1e267b01a78be40e7a02612b331b1d9291da8e4330dea10bf786acbc69f25e0baece45fb3bafe1f4389f420ebaa62373e4f035a45e34eada6f72c7c61d2302ed |
C:\Users\Admin\AppData\Roaming\discord\MediaFoundationWidevineCdm\x64\1.0.2738.0\_metadata\verified_contents.json
| MD5 | 3e839ba4da1ffce29a543c5756a19bdf |
| SHA1 | d8d84ac06c3ba27ccef221c6f188042b741d2b91 |
| SHA256 | 43daa4139d3ed90f4b4635bd4d32346eb8e8528d0d5332052fcda8f7860db729 |
| SHA512 | 19b085a9cfec4d6f1b87cc6bbeeb6578f9cba014704d05c9114cfb0a33b2e7729ac67499048cb33823c884517cbbdc24aa0748a9bb65e9c67714e6116365f1ab |
C:\Users\Admin\AppData\Roaming\discord\MediaFoundationWidevineCdm\x64\1.0.2738.0\manifest.fingerprint
| MD5 | d30a5bbc00f7334eede0795d147b2e80 |
| SHA1 | 78f3a6995856854cad0c524884f74e182f9c3c57 |
| SHA256 | a08c1bc41de319392676c7389048d8b1c7424c4b74d2f6466bcf5732b8d86642 |
| SHA512 | dacf60e959c10a3499d55dc594454858343bf6a309f22d73bdee86b676d8d0ced10e86ac95ecd78e745e8805237121a25830301680bd12bfc7122a82a885ff4b |
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5096_412611145\manifest.json
| MD5 | bbc03e9c7c5944e62efc9c660b7bd2b6 |
| SHA1 | 83f161e3f49b64553709994b048d9f597cde3dc6 |
| SHA256 | 6cce5ad8d496bc5179fa84af8afc568eeba980d8a75058c6380b64fb42298c28 |
| SHA512 | fb80f091468a299b5209acc30edaf2001d081c22c3b30aad422cbe6fea7e5fe36a67a8e000d5dd03a30c60c30391c85fa31f3931e804c351ab0a71e9a978cc0f |
C:\Users\Admin\AppData\Roaming\discord\component_crx_cache\oimompecagnajdejgnnjijobebaeigek_1.d9a253514b6a010dfc1916c55246797e5773f13844ea3ec2d25078e845fef760
| MD5 | 17c227679ab0ed29eae2192843b1802f |
| SHA1 | cc78820a5be29fd58da8ef97f756b5331db3c13e |
| SHA256 | d9a253514b6a010dfc1916c55246797e5773f13844ea3ec2d25078e845fef760 |
| SHA512 | 7e33288afd65948a5752323441c42fcc437d7c12d1eaf7a9b6ae1995784d0771e15637f23cc6bc958e40ea870414543d67a27b4c20331fde93d5b6dc6a59cbaf |
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5096_710366588\manifest.json
| MD5 | 2648d437c53db54b3ebd00e64852687e |
| SHA1 | 66cfe157f4c8e17bfda15325abfef40ec6d49608 |
| SHA256 | 68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806 |
| SHA512 | 86d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828 |