Overview
overview
5Static
static
3BetterDisc...ws.exe
windows11-21h2-x64
4$PLUGINSDI...ge.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3BetterDiscord.exe
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
5d3dcompiler_47.dll
windows11-21h2-x64
3ffmpeg.dll
windows11-21h2-x64
3libEGL.dll
windows11-21h2-x64
3libGLESv2.dll
windows11-21h2-x64
3resources/app.js
windows11-21h2-x64
3swiftshade...GL.dll
windows11-21h2-x64
3swiftshade...v2.dll
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
3vulkan-1.dll
windows11-21h2-x64
3Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-08-2024 02:48
Static task
static1
Behavioral task
behavioral1
Sample
BetterDiscord-Windows.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/BgImage.dll
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
BetterDiscord.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
d3dcompiler_47.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
ffmpeg.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
libEGL.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
libGLESv2.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
resources/app.js
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
swiftshader/libEGL.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
swiftshader/libGLESv2.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
vk_swiftshader.dll
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
vulkan-1.dll
Resource
win11-20240802-en
General
-
Target
BetterDiscord-Windows.exe
-
Size
75.1MB
-
MD5
43327119366e52928b9aed0c1e734389
-
SHA1
3777d8387fba8528b6e433a8e763df5dcd542a48
-
SHA256
249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697
-
SHA512
bda75994e6dcf5bc9e5b45d025894d62d0138a9d39c47255cd3b6b6e32f60de973da54bf85de57e8f0ca8a253bf414697c4b06e887d45dded90485ce6832e7f4
-
SSDEEP
1572864:DMKQ/QO4cQ0dPUnqZUPsziv5IANK+4ZYPDHdH/I1z/dHazC:DzXr50lUnqEneWlWYj21zaC
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
chrome.exedescription ioc process File opened for modification C:\Windows\SystemTemp chrome.exe -
Executes dropped EXE 5 IoCs
Processes:
BetterDiscord.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exepid process 4744 BetterDiscord.exe 1932 BetterDiscord.exe 248 BetterDiscord.exe 2056 BetterDiscord.exe 1000 BetterDiscord.exe -
Loads dropped DLL 11 IoCs
Processes:
BetterDiscord-Windows.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exepid process 3068 BetterDiscord-Windows.exe 3068 BetterDiscord-Windows.exe 3068 BetterDiscord-Windows.exe 4744 BetterDiscord.exe 1932 BetterDiscord.exe 248 BetterDiscord.exe 2056 BetterDiscord.exe 1932 BetterDiscord.exe 1932 BetterDiscord.exe 1932 BetterDiscord.exe 1000 BetterDiscord.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
BetterDiscord.exeBetterDiscord.exeBetterDiscord-Windows.exeBetterDiscord.exeBetterDiscord.exeBetterDiscord.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BetterDiscord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BetterDiscord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BetterDiscord-Windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BetterDiscord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BetterDiscord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BetterDiscord.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133674726326517514" chrome.exe -
Modifies registry class 64 IoCs
Processes:
BetterDiscord.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\MRUListEx = ffffffff BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\MRUListEx = ffffffff BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff BetterDiscord.exe Set value (str) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents" BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0 BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\NodeSlot = "5" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "4" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\NodeSlot = "6" BetterDiscord.exe Set value (str) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Documents" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000bbbd33fcede4da012e04e924f4e4da01e649ea24f4e4da0114000000 BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} BetterDiscord.exe Set value (str) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 BetterDiscord.exe Set value (str) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0 BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff BetterDiscord.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e8005398e082303024b98265d99428e115f0000 BetterDiscord.exe Set value (str) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 BetterDiscord.exe Set value (str) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\TV_FolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff BetterDiscord.exe Set value (str) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\TV_TopViewVersion = "0" BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 BetterDiscord.exe Set value (data) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" BetterDiscord.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" BetterDiscord.exe Set value (int) \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" BetterDiscord.exe -
Processes:
BetterDiscord.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C BetterDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 BetterDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 BetterDiscord.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
BetterDiscord.exeBetterDiscord.exechrome.exeBetterDiscord.exepid process 248 BetterDiscord.exe 248 BetterDiscord.exe 2056 BetterDiscord.exe 2056 BetterDiscord.exe 4692 chrome.exe 4692 chrome.exe 1000 BetterDiscord.exe 1000 BetterDiscord.exe 1000 BetterDiscord.exe 1000 BetterDiscord.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
BetterDiscord.exepid process 4744 BetterDiscord.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
chrome.exepid process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
chrome.exepid process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
chrome.exepid process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
BetterDiscord.exepid process 4744 BetterDiscord.exe 4744 BetterDiscord.exe 4744 BetterDiscord.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BetterDiscord-Windows.exeBetterDiscord.exechrome.exedescription pid process target process PID 3068 wrote to memory of 4744 3068 BetterDiscord-Windows.exe BetterDiscord.exe PID 3068 wrote to memory of 4744 3068 BetterDiscord-Windows.exe BetterDiscord.exe PID 3068 wrote to memory of 4744 3068 BetterDiscord-Windows.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 1932 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 248 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 248 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 248 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 2056 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 2056 4744 BetterDiscord.exe BetterDiscord.exe PID 4744 wrote to memory of 2056 4744 BetterDiscord.exe BetterDiscord.exe PID 4692 wrote to memory of 3816 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 3816 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe PID 4692 wrote to memory of 4748 4692 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BetterDiscord-Windows.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord-Windows.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exeC:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=gpu-process --field-trial-handle=1552,14631556901581794092,15729118359320450301,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1560 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1552,14631556901581794092,15729118359320450301,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:248 -
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=renderer --field-trial-handle=1552,14631556901581794092,15729118359320450301,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\BetterDiscord.exe" --type=gpu-process --field-trial-handle=1552,14631556901581794092,15729118359320450301,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2140 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1000
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5064
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff84beecc40,0x7ff84beecc4c,0x7ff84beecc582⤵PID:3816
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1956 /prefetch:22⤵PID:4748
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1844,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1996 /prefetch:32⤵PID:776
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2244 /prefetch:82⤵PID:3224
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:4820
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:3716
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4476,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3596 /prefetch:12⤵PID:560
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4704,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4748 /prefetch:82⤵PID:4492
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4952 /prefetch:82⤵PID:2060
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4772,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4356 /prefetch:12⤵PID:1824
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=872,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:4872
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3232,i,8091807740140152263,8780692465463490745,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2568
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4924
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:4384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\25a137e2-bab5-41aa-80e3-f889151333e6.tmp
Filesize8KB
MD5ca758419aee8c3fed25b2bb0be157030
SHA11e795cb59a10de25fedcb9f7605496f44aa2f1e3
SHA256b3bc2ec2e7aa71d42fad4fb81fdd899106ce8a3cc55e3da0e741cac61a232256
SHA5128ff2884c2e2f1db4758dd8912d2eb5911fda316983c62bd2f74d352a6a72ab225fa0c39d6ef895464ee1c41cda9d3f6e32b703381c7f7a17ee346b375f138f6e
-
Filesize
210KB
MD548d2860dd3168b6f06a4f27c6791bcaa
SHA1f5f803efed91cd45a36c3d6acdffaaf0e863bf8c
SHA25604d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77
SHA512172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e
-
Filesize
216B
MD55e008405069e1832da57a111ec6bebc5
SHA15129e8c0a11ec66d4036ab0b9c0b4dcd166e0e50
SHA25617e745417b47cb7831c62a72392f6486aa970b530dd6910b9bdb7e92511e9221
SHA5128eae36a9dda9a67a4c7db27374b33011c7c99fe383a997066b2598e95d64ae089ed5fd4ff3cb4d1243c463296f553163aca2dbab65a889755e99eff251b4898e
-
Filesize
216B
MD510e9d51b543994e59c3033ba0fea7452
SHA1ce9a61de4a8f51eed18800f25e8a28ae4490e59a
SHA2564af6d6742887cf8c05270da4bad661eb9632e8486151827daefd6c5dfd2e9aee
SHA5128d9a2c65287381833a6bf4be20fd3c95e892332e443cd2b4e12df9c3ef508b09f2ce65b76843dc96e5ea39597031fd80e3b8fb55e2506a29d2ae5689ccac2012
-
Filesize
2KB
MD528de925be1a1a7edcd3037205a478c4d
SHA17cf1b425bb4d290ba426cdc76c4aa8e220d4d181
SHA2567bd9f7f62c2332de2146db9700cc28d56fe05bab4de0e94be288693522f81b2b
SHA5121b28f31cfcaacbee0faf97d4201a6334b462b4a2560a7be00704268e6536509288c3a3d9c73acebe1869fbf1138ad7e76c0525b5eda4681d92c67cd9f8d6db5a
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD574fc1f531b7e64c3243584750c2a4405
SHA1e21c64046767385421a29d4f7855043331569080
SHA2566fa4f4f4d3d5bca865c0859882f0ecf7de4b0e4957d98393561d27f7b5241d45
SHA51207c9a98e0a50fbabf4e19c28641e24d4790c01064e20d45cd14696f603ada3d58ddb813d1412191cfe50c483e70dd695aa20cde539f27cbd34b3313aedcd2358
-
Filesize
356B
MD5999fe6b037566f93b84fe78b1278d78e
SHA19a2cca6a3e5b874b875b59601b83a35e4f8ccc47
SHA2561bf1c58558fe4bb91a02c771c1651fce1509e4af9945f09c64995c8f0655ef36
SHA5124edef82aa17db6a00ed96a3e455f3a1dce45b48e110594e53769624c3f155721ee3f38f4f3883810d86c5ec699aab2932e398e74bb4f669aa06e5a6cc21566bd
-
Filesize
9KB
MD56a481ff4ebf79fe8e324cc160ff02290
SHA15c044d1a9be84e79fd387aab59d9d19f4e778e68
SHA25604bbb59e46f0a38db2ee8a3dd75b31e806c9424d95aca305cd6a3270d630a9d8
SHA5127b2a4597bfa6722cb93307797d09285888a4c4de9386c8d2efecb3098f041054ef7b6a9456366c9528de929d31d1dc759c5e4b150ade21aa783497c61d4b14aa
-
Filesize
8KB
MD5166d64e13d145dd6e7207ca9af6d2d34
SHA1e865071730db529e8037b10c66f4b5dfdc93b56b
SHA2563a16e09b020c890678e4f809409bdc997d3483c5a9b050ac5127e5fefe174184
SHA512df8a3f75bed80fcc4014c2aab4789e582e48c846f10e9568587e2a7a1c9ab73671fee56e9f080cf198e2e7775c680521dda2e1cdad65bad890e3a27dff810b88
-
Filesize
9KB
MD5a3dad05d293ac0d46e40ece0a46c41e7
SHA1789329f52b2b7a85d1e367734e5d6bb41cee29ec
SHA2566146352212e403f59f66825cdd4dac8488bfd76b6698ae59e7357af5d21503c7
SHA5121f6aa3dbfad818976a4d2fcf50ed30fe9de314c6781a0cac6bd019bb408f133db24655591913f38cd9bc08537fb085d63a95e737501f1c5d45cc9b3cdad741e2
-
Filesize
9KB
MD5c39abf3b10c63cbf82c4ae0b8e30e484
SHA162826faf5d7c2a85c13a1af45e8f9693e8c6057a
SHA256996698dab2f238ae3633ae007b1a7b8fb1ae78cb07c833ad34b55a5dad202324
SHA512cae35288416ecfe354bc9b220325e145b592a1cc9b0171ae79d6b171d22d74a645408847c9be19464e314df5d4f7587e8368d41e24fd8d2a044f54bd441d7076
-
Filesize
9KB
MD50adb4aa8e7f56b3b260afe3b564b7f9f
SHA12baf12447375ab05245011770b1fb4db1550a1c0
SHA256399da489cf393b65ad960ce822dc0bbf3ddb7909adebb558181dfee02a6e7f1e
SHA5122f2620a1be8c11cafa25b0b2a3edb9101626f9e75021170b9fd50c2c548302e01441163ed3399dc26464661704305745810a095966e23191cb2ecfda49d45932
-
Filesize
9KB
MD569286be73aaede0c0edfe7f0c4ff63a9
SHA12851598a4784546cef285f6bd971e182e5bacbbe
SHA256654b4c00b15d7d8f3e315a3dc94ce3e8a3b78e3bb08eba35bb3456a25a5bf4a2
SHA512a93c6c8d37f60e9983ff1eb351651899c313fcd866625de2bd21471f432b2ec4a33d88086ab547b03873f911ada1430fd53db4431d137f5137d7d4aa06c052dd
-
Filesize
9KB
MD561daeb41ffb6387c17b1506d0c7611d8
SHA181dbcc36d49ac5f91f8db8704d39a0e52def4e82
SHA25650531c00c5bc25a2e2702ca0656cfe5beed195515e8241a4e3083335c3ab586c
SHA512dc25d8a6855d869351e5fb8389571231aecdd6c3db35650a72472136d22503d5b9e576e75f8d93b2a27fc4e799e4f4aa0ec501c8ed720ed202101137c1f4a091
-
Filesize
15KB
MD581a155d6babd750f300d12eaaa968315
SHA1b39b19469b83f1dd18a55d8d46e6504edd58c44f
SHA256a36cc67dff450bfe451f16ee78f869c0d2beaedc8c7817ee069e9c60623fdb40
SHA5129a77dfe7d09dd57ff641eb3826d71ff05c952759c5f634c148ef402c8cde760236de7db26a849672422c9ce30b4d17e1bff3ba03d403a6d98da3f3f83874ff47
-
Filesize
194KB
MD59f1d9304683652bdf7252ada097f19f2
SHA1c1bc1a13a8f597d865678c8ebc31131524838475
SHA256e237c8497d3e4202b695eea32f24644f9fc3760b984608625af23e0a4b54eca9
SHA5122a625aeb094694985ede8a3e5d2cdb122c7569e4a954eacd970b039c0c417e70cb489c08408ead81b4344fc63435f5aa387a38b8f0cdfa879c1fdb16dadcddd8
-
Filesize
194KB
MD5e86fe096e9b35d443165bb8393b02bca
SHA17800c4ba4a4d465775bba406faa0448855024c5a
SHA2561ae78cabb8e93623ebd5fc44f8d88c6d0c0ea09541505a4453fcf86846dfeeb1
SHA51255cb363d3e320bbc52ebac7aa877326fed4f509386796ea51f733054b1809895b35e6218098e20a6025ef4fbccbf63d746b0621934bfbcb90d96a4236ac05ca0
-
Filesize
194KB
MD5bf81f3ac4f937650c53d41f530fda70a
SHA1fe8d3765079bb9e2e0d5c6de6dceeeef5d8721dc
SHA256d3718a57ddf6f71dfe061c1842632f93589b41d604f3ff9b48188aed53835534
SHA5122b96fb15749da014ad9b942cf08fa7f8d8baebc60c82bea14b8abf03ad77f1ed7238ebe72d9572488afa8ac07d68ca660b377cd6686e475322477288070c64d9
-
Filesize
3.5MB
MD52f2e363c9a9baa0a9626db374cc4e8a4
SHA117f405e81e5fce4c5a02ca049f7bd48b31674c8f
SHA2562630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df
SHA512e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924
-
Filesize
138KB
MD503aaa4f8525ba4b3e30d2a02cb40ab7a
SHA1dd9ae5f8b56d317c71d0a0a738f5d4a320a02085
SHA256c3f131faeefab4f506bf61c4b7752a6481f320429731d758ef5413a2f71441f7
SHA512c89a1b89b669602ba7c8bf2c004755cac7320189603fecb4f4c5cf7a36db72da651c7b613607146f0c6da9eec5df412c7fba75475352192351c02aebdaa7d9a9
-
Filesize
202KB
MD57d4f330a5443eadf32e041c63e7e70ad
SHA126ce6fb98c0f28f508d7b88cf94a442b81e80c88
SHA256b8704be578e7396ee3f2188d0c87d0ede5c5702e9bb8c841b5f8d458abf1356d
SHA512f1b9b0dd7396863aa0feca06175b7f9ea0be4122351ecf0a0549ee4c34f85ac8c63cc927d7409a40b6e19fa91d2cb00a145616ba19f47045b2345bfbc2d4802d
-
Filesize
2.5MB
MD5d2cc6fc3a7b6c5bcca5fae428fe799e0
SHA189cba6e9195cf95a7aa993d7aaadb331392b3bda
SHA2560d4ebdd32f016c6eb203aef4c70ad2f93fa68e5b9e92087a862b21f8133c7319
SHA51234f7e6c49ff2a230abc7c5aeeebc5ec628f07170c4638b3bfc5897a645fa5f167c54230373a39021548e0aceba50c35ef730e4ecb454bb4d882df2d699c86736
-
Filesize
9.9MB
MD580a7528515595d8b0bf99a477a7eff0d
SHA1fde9a195fc5a6a23ec82b8594f958cfcf3159437
SHA2566e0b6b0d9e14c905f2278dbf25b7bb58cc0622b7680e3b6ff617a1d42348736b
SHA512c8df47a00f7b2472d272a26b3600b7e82be7ca22526d6453901ff06370b3abb66328655868db9d4e0a11dcba02e3788cc4883261fd9a7d3e521577dde1b88459
-
Filesize
346KB
MD5dccd99cb80c5022d4ed21c068d4e4ae5
SHA14fcdc6be313d0e3baa5168a7556df992e3364da4
SHA2562166f8830bfbf3d574d7654bd927fe6e05fb74fb05d8e57af59c93090f6bc2a6
SHA51202f18a691d85545a0452631b1c1e218aa5853d71937f7ae1d4f3639142399017139c1d9cb81f769754303635ce689605a7fd65765a3d8b4873603ced57925faf
-
Filesize
6.6MB
MD5d36a30ef5726be3e3b3ed3f886a781a8
SHA10a47ed6013866aef030683e0398937013ce7fdf0
SHA2563672e62c20b1d253ad642e155ae32ba5c1ca1f2cce37565c71a7d8aad21515dd
SHA5128ac4adc7879cc7b0661809394e118220a350c9b8063aadf44fcecd115411fcc040ea73cb1fb2896931c34ec04b6146e5b5f7cda531249698dceb09aa1f9b4078
-
Filesize
88KB
MD5af5c77e1d94dc4f772cb641bd310bc87
SHA10ceeb456e2601e22d873250bcc713bab573f2247
SHA256781ef5aa8dce072a3e7732f39a7e991c497c70bfaec2264369d0d790ab7660a4
SHA5128c3217b7d9b529d00785c7a1b2417a3297c234dec8383709c89c7ff9296f8ed4e9e6184e4304838edc5b4da9c9c3fe329b792c462e48b7175250ea3ea3acc70c
-
Filesize
4.9MB
MD591f8a4b158df6967163ccbbe765e095a
SHA195db67f0a2352fd898f4a4cfdfc860f6a9c58c87
SHA256a30b8269e588c6cc2cea5fd4685da3012fd10451edb59a283005116f8e033182
SHA5126450d75d53f24d11e1c1e7e3cacfc57ee9dd09c00ca0dc2ff30f580b59a6b17e7ad7d96682195bd7d806b49068653538c77ca4200491560cecff128a0b012d92
-
Filesize
1.1MB
MD5f64750a616dcdafc38fa3fdaa966fbc5
SHA1358b77012f4a1a9c96f6370d4f7b96ab55e302fa
SHA256eaddb78f5f24d73c75e3f016457e79f0c1685d5add4ec5647efdcb3e5841b7b5
SHA51246221e0b9c11674847b9de39a23effa339ece2fb15ca6036e1bc4444f0dbe1ad6ded144ed2ae511525034210842614d295f001dab64b360c97fb9e2cf3f9e984
-
C:\Users\Admin\AppData\Local\Temp\2PqhVVPE5kPb0ewa547FygNUcPX\resources\assets\images\background.png
Filesize297B
MD532338b60ff8368fd431b32109eae89d2
SHA17a3a844f2e6371c8f3a08a142e2e792a6e77105a
SHA2561d370406c3b0c6bfe109feb76229fd4a0fe1d4171ae2a77655a0fd3264558d2f
SHA512be71b3dcc24cea203d59e08d8a4082dcf253eb02a971e67034f8cc0930f6af72830b1e35430cc861c08341082156585adcedcbfc788a83ec35fbd78107e20f2f
-
Filesize
2KB
MD5a2636a83d1e5d412d1459b3134f0a3e0
SHA1ad04552d42a12e0aad79995bba521d163f1c6af3
SHA256dfd3446ba31a55a11b45e0196b4eb2800e0271749c99102660d0df59f2ad9b85
SHA512c51cf43252083bd2c5a31510f8a1e34bc08b3c142484d40f04d4979bfd334c9c34456f4908ae881e90de355551bccefecf88de187383dc0a0d8e9d146917bb80
-
Filesize
1KB
MD5d17d46244937c3705cccfe590b5a3d0b
SHA1318949d0fd6d1638c7e0bb170e59b8d2f3662e34
SHA256b5b0f8076b0ac106fcc8f172b5e81516b69387f4119ca54715bd00739861fa27
SHA512930eee25bddfe72835f5ebf6d5bec2e05e2e3a8740a588264efb8b7bb1dd7b46d3ff402206124b5a9878ce317bc64cb53d7fe0611e2a20902e9fc129760dd861
-
Filesize
2KB
MD5f31549cdc3abfa48981759862a07519e
SHA11168fdb04883a65057168eaccb75e153aa3fe438
SHA256267c8e6f5387fa5d54290044d30a5da427be3597fa7815c32689a533eaee8886
SHA512f084f518eafc6a58c377c3f80d8a186d9a1d55473afc931bb913adb1fa6fd0bbbc2ba09a30ea39283cd5327079278ae7babea6a74b93a7f2d7cb48bfbba95795
-
Filesize
161KB
MD5d88d23551a4d7230f98fe0cbd363695b
SHA18e28eb4153e00aa5345bdb539b925a777588a26b
SHA25672c3c123f10eb6e24c83ee40727a3a632cf7a8b062a3b7c7b41db4bfeda52ce4
SHA512ea757e91c7cfc766b35da226263e82646f5b1153b8800c5cd69321d98b6d424413dcd7a02413a6a0e2f34905daf84bd21302b7ad58f2ebd814a7ac0a92b9d284
-
Filesize
7KB
MD5487368e6fce9ab9c5ea053af0990c5ef
SHA1b538e37c87d4b9a7645dcbbd9e93025a31849702
SHA256e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
SHA512bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
175B
MD52b7e4377653e6e07536efe7fc1bd78a7
SHA1cdd9c03b91e368bc14c4ac0ff7204ee698fa285d
SHA256bd367325bb3c469e1aa6dcff50b6296b9b8d5bf5bed538f01f36c29b0603511a
SHA5125dae5ba1af5ae6e52a39092bc5b4ebb454906c919735ab5b7f7a4c84a487e26376f68aee9c86265142e03c0f163cc0623094fa4f2936bff17504c2059ba112dc
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e