Overview
overview
7Static
static
3BetterDisc...1).exe
windows7-x64
7BetterDisc...1).exe
windows10-2004-x64
5$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3BetterDiscord.exe
windows7-x64
5BetterDiscord.exe
windows10-2004-x64
5LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
3ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
3libGLESv2.dll
windows10-2004-x64
3resources/app.js
windows7-x64
3resources/app.js
windows10-2004-x64
3swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
3vulkan-1.dll
windows10-2004-x64
3Analysis
-
max time kernel
178s -
max time network
221s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09-07-2024 23:16
Static task
static1
Behavioral task
behavioral1
Sample
BetterDiscord-Windows (1).exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
BetterDiscord-Windows (1).exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
BetterDiscord.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
BetterDiscord.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
ffmpeg.dll
Resource
win7-20240708-en
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win7-20240704-en
Behavioral task
behavioral17
Sample
libEGL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
libGLESv2.dll
Resource
win7-20240704-en
Behavioral task
behavioral19
Sample
libGLESv2.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral20
Sample
resources/app.js
Resource
win7-20240705-en
Behavioral task
behavioral21
Sample
resources/app.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
swiftshader/libEGL.dll
Resource
win7-20240705-en
Behavioral task
behavioral23
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240704-en
Behavioral task
behavioral25
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win7-20240705-en
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win7-20240704-en
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win10v2004-20240709-en
General
-
Target
BetterDiscord-Windows (1).exe
-
Size
75.1MB
-
MD5
43327119366e52928b9aed0c1e734389
-
SHA1
3777d8387fba8528b6e433a8e763df5dcd542a48
-
SHA256
249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697
-
SHA512
bda75994e6dcf5bc9e5b45d025894d62d0138a9d39c47255cd3b6b6e32f60de973da54bf85de57e8f0ca8a253bf414697c4b06e887d45dded90485ce6832e7f4
-
SSDEEP
1572864:DMKQ/QO4cQ0dPUnqZUPsziv5IANK+4ZYPDHdH/I1z/dHazC:DzXr50lUnqEneWlWYj21zaC
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BetterDiscord.exeBetterDiscord.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\International\Geo\Nation BetterDiscord.exe Key value queried \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\International\Geo\Nation BetterDiscord.exe -
Executes dropped EXE 5 IoCs
Processes:
BetterDiscord.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exepid process 2132 BetterDiscord.exe 3016 BetterDiscord.exe 1464 BetterDiscord.exe 2292 BetterDiscord.exe 1656 BetterDiscord.exe -
Loads dropped DLL 19 IoCs
Processes:
BetterDiscord-Windows (1).exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exepid process 560 BetterDiscord-Windows (1).exe 560 BetterDiscord-Windows (1).exe 560 BetterDiscord-Windows (1).exe 560 BetterDiscord-Windows (1).exe 2132 BetterDiscord.exe 2132 BetterDiscord.exe 3016 BetterDiscord.exe 2132 BetterDiscord.exe 1464 BetterDiscord.exe 2132 BetterDiscord.exe 2292 BetterDiscord.exe 3016 BetterDiscord.exe 3016 BetterDiscord.exe 3016 BetterDiscord.exe 2132 BetterDiscord.exe 1656 BetterDiscord.exe 1656 BetterDiscord.exe 1656 BetterDiscord.exe 1656 BetterDiscord.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 35 IoCs
Processes:
BetterDiscord.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1" BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots BetterDiscord.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" BetterDiscord.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c00310000000000e458c58610204c6f63616c00380008000400efbee4580384e458c5862a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000 BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 BetterDiscord.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c00434653461600310000000000e4580384122041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbee4580384e45803842a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000042000000 BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} BetterDiscord.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
BetterDiscord.exeBetterDiscord.exeBetterDiscord.exechrome.exepid process 1464 BetterDiscord.exe 2292 BetterDiscord.exe 2132 BetterDiscord.exe 2132 BetterDiscord.exe 2392 chrome.exe 2392 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe Token: SeShutdownPrivilege 2392 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe 2392 chrome.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
BetterDiscord.exeAcroRd32.exepid process 2132 BetterDiscord.exe 2132 BetterDiscord.exe 2132 BetterDiscord.exe 2720 AcroRd32.exe 2720 AcroRd32.exe 2720 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BetterDiscord-Windows (1).exeBetterDiscord.exedescription pid process target process PID 560 wrote to memory of 2132 560 BetterDiscord-Windows (1).exe BetterDiscord.exe PID 560 wrote to memory of 2132 560 BetterDiscord-Windows (1).exe BetterDiscord.exe PID 560 wrote to memory of 2132 560 BetterDiscord-Windows (1).exe BetterDiscord.exe PID 560 wrote to memory of 2132 560 BetterDiscord-Windows (1).exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 3016 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1464 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1464 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1464 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1464 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 2292 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 2292 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 2292 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 2292 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1656 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1656 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1656 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1656 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1656 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1656 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1656 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1656 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1656 2132 BetterDiscord.exe BetterDiscord.exe PID 2132 wrote to memory of 1656 2132 BetterDiscord.exe BetterDiscord.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BetterDiscord-Windows (1).exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord-Windows (1).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exeC:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=gpu-process --field-trial-handle=1060,9788628148801853799,14430845278031476287,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1056 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1060,9788628148801853799,14430845278031476287,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1364 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=renderer --field-trial-handle=1060,9788628148801853799,14430845278031476287,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1436 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=gpu-process --field-trial-handle=1060,9788628148801853799,14430845278031476287,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1056 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2720
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7dd9758,0x7fef7dd9768,0x7fef7dd97782⤵PID:1344
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:22⤵PID:1180
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:82⤵PID:1448
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1544 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:82⤵PID:2944
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2256 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:12⤵PID:940
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:12⤵PID:2672
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1460 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:22⤵PID:1968
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1312 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:12⤵PID:3020
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3620 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:82⤵PID:2364
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level2⤵PID:2752
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x140007688,0x140007698,0x1400076a83⤵PID:2100
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3432 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:12⤵PID:2744
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1084 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:12⤵PID:1180
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=688 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:12⤵PID:948
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2360 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:82⤵PID:2684
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 --field-trial-handle=1364,i,9948593700930299557,3375998261810955375,131072 /prefetch:82⤵PID:1296
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1012
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2e81⤵PID:2768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
361B
MD5cbafd0a15425ca8da3cfd394b3fac72c
SHA15dcf74473ed83468cc2c5f3080bcf8efb671ee63
SHA2562dde614fd23b6feb3658a81ef262bf7ef811ad1f90e7853330bff4e9abbbb8cf
SHA512c2c4f109bb017184b6628b1ae7cf1da78abf48cc5d863e3d8d153494dbf9d4c3131bd53d7d07beac3f67524240745e1c92b4f7bbaf526f428a40b5b794855d56
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
4KB
MD52724102ba7eb77089e398a05891a5da7
SHA1bb54e71d86c8f3576316e2f4ebd709afb8386a24
SHA256f1c7f68fef90b03d2629d41dce8e78746e469e7c78987c82cd5476dedfed9585
SHA51288a3f9ff60f071d83dc796fa048e38c87ab488d850092518333aa7b90e4b4086877508872be98ba02fda43535cb176cdb5818fe137cddc401aea00a39b623375
-
Filesize
4KB
MD5c47df8c271bc31df37a11473aee52868
SHA18dba93b22c74ff46556321d830772abec562b6c2
SHA256a5426348d832b2988aa6468ef53080d604a3701e88dc231163a4940916f7de67
SHA5125ca0ada02f7a230e39db9b7fcb8109b0ccda305c47610aa4ceb59933da93b9b28a86171ade7c24a2b963cc667151447c9780f87ad83b2f66c134bf194b227266
-
Filesize
4KB
MD5d932c6019865f89640c02588c7ea0bcb
SHA16fe8758e70f8b7b573b65e10ca320accc28fcc96
SHA2566916d665df70adf4b97ade8b7d1ab7bcf80858f0f3b43a03944f053bff1c6d12
SHA51249df4e6ecc52b5aaf0b87abe4a66d459479a693480b20f7e1dcfe90326598ee03b9d8b6718bdb7ab8512051ae7d14a553c6b96e69f19421026d0f7f8a2904fe3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize176B
MD5cf5d9b1149e6c79bfc7c7770e0d8f291
SHA1ceb78bd0fd327dd9a511c8c1e1338a5474022b15
SHA2562192a43ddd735daba1563ccc585edcba323ae4e03b38a41a760cf412df02aa1b
SHA512813a1b000b1384c3d920ef54984a3c4153df7f455ff562fdcfafa17ad0b1a3b7163684d07983a98e9488b2c2d215b31a605804aaf6cb3af9b1afa08435c3d228
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
3.5MB
MD52f2e363c9a9baa0a9626db374cc4e8a4
SHA117f405e81e5fce4c5a02ca049f7bd48b31674c8f
SHA2562630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df
SHA512e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924
-
Filesize
138KB
MD503aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9
-
Filesize
202KB
MD57d4f330a5443eadf32e041c63e7e70ad
SHA126ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA256b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
SHA512f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d
-
Filesize
2.5MB
MD5d2cc6fc3a7b6c5bcca5fae428fe799e0
SHA189cba6e9195cf95a7aa993d7aaadb331392b3bda
SHA2560d4ebdd32f016c6eb203aef4c70ad2f93fa68e5b9e92087a862b21f8133c7319
SHA51234f7e6c49ff2a230abc7c5aeeebc5ec628f07170c4638b3bfc5897a645fa5f167c54230373a39021548e0aceba50c35ef730e4ecb454bb4d882df2d699c86736
-
Filesize
9.9MB
MD580a7528515595d8b0bf99a477a7eff0d
SHA1fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA2566e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
SHA512c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459
-
Filesize
88KB
MD5af5c77e1d94dc4f772cb641bd310bc87
SHA10ceeb456e2601e22d873250bcc713bab573f2247
SHA256781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
SHA5128c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c
-
Filesize
4.9MB
MD591f8a4b158df6967163ccbbe765e095a
SHA195db67f0a2352fd898f4a4cfdfc860f6a9c58c87
SHA256a30b8269e588c6cc2cea5fd4685da3012fd10451edb59a283005116f8e033182
SHA5126450d75d53f24d11e1c1e7e3cacfc57ee9dd09c00ca0dc2ff30f580b59a6b17e7ad7d96682195bd7d806b49068653538c77ca4200491560cecff128a0b012d92
-
Filesize
1.1MB
MD5f64750a616dcdafc38fa3fdaa966fbc5
SHA1358b77012f4a1a9c96f6370d4f7b96ab55e302fa
SHA256eaddb78f5f24d73c75e3f016457e79f0c1685d5add4ec5647efdcb3e5841b7b5
SHA51246221e0b9c11674847b9de39a23effa339ece2fb15ca6036e1bc4444f0dbe1ad6ded144ed2ae511525034210842614d295f001dab64b360c97fb9e2cf3f9e984
-
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\resources\assets\images\background.png
Filesize297B
MD532338b60ff8368fd431b32109eae89d2
SHA17a3a844f2e6371c8f3a08a142e2e792a6e77105a
SHA2561d370406c3b0c6bfe109feb76229fd4a0fe1d4171ae2a77655a0fd3264558d2f
SHA512be71b3dcc24cea203d59e08d8a4082dcf253eb02a971e67034f8cc0930f6af72830b1e35430cc861c08341082156585adcedcbfc788a83ec35fbd78107e20f2f
-
Filesize
2KB
MD5a2636a83d1e5d412d1459b3134f0a3e0
SHA1ad04552d42a12e0aad79995bba521d163f1c6af3
SHA256dfd3446ba31a55a11b45e0196b4eb2800e0271749c99102660d0df59f2ad9b85
SHA512c51cf43252083bd2c5a31510f8a1e34bc08b3c142484d40f04d4979bfd334c9c34456f4908ae881e90de355551bccefecf88de187383dc0a0d8e9d146917bb80
-
Filesize
1KB
MD5d17d46244937c3705cccfe590b5a3d0b
SHA1318949d0fd6d1638c7e0bb170e59b8d2f3662e34
SHA256b5b0f8076b0ac106fcc8f172b5e81516b69387f4119ca54715bd00739861fa27
SHA512930eee25bddfe72835f5ebf6d5bec2e05e2e3a8740a588264efb8b7bb1dd7b46d3ff402206124b5a9878ce317bc64cb53d7fe0611e2a20902e9fc129760dd861
-
Filesize
2KB
MD5f31549cdc3abfa48981759862a07519e
SHA11168fdb04883a65057168eaccb75e153aa3fe438
SHA256267c8e6f5387fa5d54290044d30a5da427be3597fa7815c32689a533eaee8886
SHA512f084f518eafc6a58c377c3f80d8a186d9a1d55473afc931bb913adb1fa6fd0bbbc2ba09a30ea39283cd5327079278ae7babea6a74b93a7f2d7cb48bfbba95795
-
Filesize
366KB
MD5c51dc7e0ca92c9a45467a202aeceebf3
SHA15f35ec0c4e9b7663d7467a6c5f10062479519758
SHA2560d4015adb1b1a4996378e06c9341b19d00e3cab8d18c002197ea9311feaf5d11
SHA5128439f2a36f0a85dbfe12e786672278c6f6250be5029313efa285f851491357e134d6c9e03b339985eb255e80988e82d37540ffaef4f358c4428f6fc6aaec9ab0
-
Filesize
2.7MB
MD55629b1c0102dcc1e4217276efdc60630
SHA1ffdd7bd4131c53b0ec5725ed8a8529b4be677232
SHA256dac51738a42514c68ec31c962e608f6ce4a5a4244b787d2ba404a6a6065d8244
SHA5128606a5e86172ab1f8cd65927b5139658e42ccf3fa870c27c2ce2a36cdfbffd3764f2efe83d4cc76c676c89d9fede70ca643950f370bbbd0b1dc8d2df005c46cd
-
Filesize
161KB
MD5d88d23551a4d7230f98fe0cbd363695b
SHA18e28eb4153e00aa5345bdb539b925a777588a26b
SHA25672c3c123f10eb6e24c83ee40727a3a632cf7a8b062a3b7c7b41db4bfeda52ce4
SHA512ea757e91c7cfc766b35da226263e82646f5b1153b8800c5cd69321d98b6d424413dcd7a02413a6a0e2f34905daf84bd21302b7ad58f2ebd814a7ac0a92b9d284
-
Filesize
3KB
MD534c7adb9012834c09f0d58e86aa67bc3
SHA142385cbbe746118ed203ec5a31da623f5b50576a
SHA256f201c372d4d5e999d98254fe37e75ecc001b68a44339eac96f713fc9298075b9
SHA512c8de84895432ebda44f43a740d3644ae8ed5973ecbae84a20fbe6e8910ad3afdc5d4c8ef133325ca8fd614fd74e342aba9894409145ad2f3d16c35d65b0a8e8a
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
346KB
MD5dccd99cb80c5022d4ed21c068d4e4ae5
SHA14fcdc6be313d0e3baa5168a7556df992e3364da4
SHA2562166f8830bfbf3d574d7654bd927fe6e05fb74fb05d8e57af59c93090f6bc2a6
SHA51202f18a691d85545a0452631b1c1e218aa5853d71937f7ae1d4f3639142399017139c1d9cb81f769754303635ce689605a7fd65765a3d8b4873603ced57925faf
-
Filesize
6.6MB
MD5d36a30ef5726be3e3b3ed3f886a781a8
SHA10a47ed6013866aef030683e0398937013ce7fdf0
SHA2563672e62c20b1d253ad642e155ae32ba5c1ca1f2cce37565c71a7d8aad21515dd
SHA5128ac4adc7879cc7b0661809394e118220a350c9b8063aadf44fcecd115411fcc040ea73cb1fb2896931c34ec04b6146e5b5f7cda531249698dceb09aa1f9b4078
-
Filesize
7KB
MD5487368e6fce9ab9c5ea053af0990c5ef
SHA1b538e37c87d4b9a7645dcbbd9e93025a31849702
SHA256e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
SHA512bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9